Do you mean ptrace? One of the advantages of eBPF is that it runs in the kernel so you don't need to context switch to another user space process. A number of s

Do you mean ptrace? One of the advantages of eBPF is that it runs in the kernel so you don't need to context switch to another user space process. A number of syscalls are significantly cheaper than a user space context switch. The rr debugger[0], which needs to process all syscalls, uses an eBPF based filter to select certain simple syscalls for in-process handling and avoid context switching through ptrace. [0] http://rr-project.org/ http://rr-project.org/