Tool tracing syscalls in a fast way using eBPF linux kernel feature
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.
doc Replace KProbe with Kprobe and TracePoint with Tracepoint Jun 14, 2017
src Update required bcc version to 0.4.0 Nov 16, 2017
tools Merge pull request #39 from ldorau/ Oct 12, 2017
CMakeLists.txt Add new Jun 14, 2017 Correct Jun 14, 2017
LICENSE Update required bcc version to 0.4.0 Nov 16, 2017 Various fixes after review Jun 29, 2017

vltrace: syscall tracer using eBPF

Build Status Coverity Scan Build Status

This is the top-level of vltrace.

vltrace is a syscall tracing tool which utilizes eBPF - an efficient tracing feature of the Linux kernel.


Please see the file LICENSE for information on how this tool is licensed.


The vltrace depends on libbcc library. The installation guide of libbcc can be found here.


  • kernel v4.7 or later (to attach eBPF to tracepoints)
  • kernel headers installed:
    • 'kernel-devel' package on RHEL, Fedora and CentOS or
    • 'linux-headers' package on Debian and Ubuntu
  • libbcc v0.4.0
  • CAP_SYS_ADMIN capability (required by the bpf() syscall)
  • mounted debugfs and tracefs


For more information about this tool contact:

  • Lukasz Dorau (lukasz.dorau at

or create an issue here.