For newcomers to BPF tracing, bpftrace is the place to start. It lets you create new tools using several lines of concise code; see the example from this articl

For newcomers to BPF tracing, bpftrace is the place to start. It lets you create new tools using several lines of concise code; see the example from this article: https://github.com/devopsspiral/ebpf-bt-unlock/blob/master/bt_dev_read.bt https://github.com/devopsspiral/ebpf-bt-unlock/blob/master/b... As BTF (BPF Type Format) becomes the default in kernels, this short tool will become even shorter: the "( struct hci_dev *) arg0" cast won't be necessary as the kernel will already know what type arg0 is. So line 9 can be skipped. I see a lot of people start with other BPF tracers that made sense years ago as we hadn't built bpftrace yet. It'll really save you a lot of time to look at bpftrace first and then others only if need be. bpftrace is installed by default on all cloud instances at Netflix and other companies: it's the go-to tool for whipping up custom tracing programs.