Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
stack trace visualizer
HTML Perl Other
tree: a6e13e2d2c

Fetching latest commit…

Cannot retrieve the latest commit at this time

Failed to load latest commit information.


Flame Graphs visualize hot-CPU code-paths.

Using DTrace, see:
Using perf_events or SystemTap, see:
Using XCode Instruments, see:

These can be created in three steps:

   1. Capture stacks
   2. Fold stacks

1. Capture stacks
Stack samples can be captured using DTrace, perf_events or SystemTap.

Using DTrace to capture 60 seconds of kernel stacks at 997 Hertz:

# dtrace -x stackframes=100 -n 'profile-997 /arg0/ { @[stack()] = count(); } tick-60s { exit(0); }' -o out.kern_stacks

Using DTrace to capture 60 seconds of user-level stacks for PID 12345 at 97 Hertz:

# dtrace -x ustackframes=100 -n 'profile-97 /PID == 12345 && arg1/ { @[ustack()] = count(); } tick-60s { exit(0); }' -o out.user_stacks

Using DTrace to capture 60 seconds of user-level stacks, including while time is spent in the kernel, for PID 12345 at 97 Hertz:

# dtrace -x ustackframes=100 -n 'profile-97 /PID == 12345/ { @[ustack()] = count(); } tick-60s { exit(0); }' -o out.user_stacks

Switch ustack() for jstack() if the application has a ustack helper to include translated frames (eg, node.js frames; see:  The rate for user-level stack collection is deliberately slower than kernel, which is especially important when using jstack() as it performs additional work to translate frames.

2. Fold stacks
Use the stackcollapse programs to fold stack samples into single lines.  The programs provided are:

- for DTrace stacks
- for perf_events "perf script" output
- for SystemTap stacks
- for XCode Instruments

Usage example:

$ ./ out.kern_stacks > out.kern_folded

The output looks like this:

unix`_sys_sysenter_post_swapgs 1401
unix`_sys_sysenter_post_swapgs;genunix`close 5
unix`_sys_sysenter_post_swapgs;genunix`close;genunix`closeandsetf 85
unix`_sys_sysenter_post_swapgs;genunix`close;genunix`closeandsetf;c2audit`audit_closef 26
unix`_sys_sysenter_post_swapgs;genunix`close;genunix`closeandsetf;c2audit`audit_setf 5
unix`_sys_sysenter_post_swapgs;genunix`close;genunix`closeandsetf;genunix`audit_getstate 6
unix`_sys_sysenter_post_swapgs;genunix`close;genunix`closeandsetf;genunix`audit_unfalloc 2
unix`_sys_sysenter_post_swapgs;genunix`close;genunix`closeandsetf;genunix`closef 48

Use to render a SVG.

$ ./ out.kern_folded > kernel.svg

An advantage of having the folded input file (and why this is separate to is that you can use grep for functions of interest. Eg:

$ grep cpuid out.kern_folded | ./ > cpuid.svg

Provided Example
An example output from DTrace is included, both the captured stacks and
the resulting Flame Graph. You can generate it yourself using:

$ ./ example-stacks.txt | ./ > example.svg

This was from a particular performance investigation: the Flame Graph
identified that CPU time was spent in the lofs module, and quantified
that time.

See the USAGE message (--help) for options:

USAGE: ./ [options] infile > outfile.svg

        --titletext             # change title text
        --width                 # width of image (default 1200)
        --height                # height of each frame (default 16)
        --minwidth              # omit smaller functions (default 0.1 pixels)
        --fonttype              # font type (default "Verdana")
        --fontsize              # font size (default 12)
        --countname             # count type label (default "samples")
        --nametype              # name type label (default "Function:")
        ./ --titletext="Flame Graph: malloc()" trace.txt > graph.svg

As suggested in the example, flame graphs can process traces of any event,
such as malloc()s, provided stack traces are gathered.
Something went wrong with that request. Please try again.