// the find
brendangregg/bpf-perf-tools-book
Official repository for the BPF Performance Tools book
The companion repo to Brendan Gregg's BPF Performance Tools book — a collection of bpftrace and BCC scripts covering everything from CPU scheduling to container overlayfs. If you're doing serious Linux performance work, Gregg's name alone is a quality signal. This is reference material, not a library you ship.
The breadth is genuine: CPUs, memory, filesystems, disks, networking, security, containers, hypervisors, and language runtimes are all covered with working tools rather than toy examples. The bpftrace scripts are deliberately short and readable — they function as textbook examples you can actually understand and modify, not opaque binaries. The split between originals/ and updated/ is honest about kernel probe churn; tools that broke on newer kernels have versioned replacements rather than silent rot. Gregg wrote most of this, which means the tracing strategies are grounded in real production debugging, not academic exercises.
The repo is effectively frozen — last push April 2024, and the updated/ directory is mostly empty READMEs with a handful of fixes. Many scripts probe internal kernel symbols that change between releases, so you will hit broken probes without warning on recent kernels (6.x+). There's no test harness or CI; whether a tool still works on your kernel is a manual exercise. The Python tools (mmapsnoop.py, shellsnoop.py) use older BCC Python bindings that are increasingly painful to install on modern distros, and there's no indication which scripts have been validated against current BCC versions.