Skip to content

Installation

Jump to bottom
thefoulowl edited this page Sep 4, 2026 · 1 revision

Installation

Requirements

  • Linux, x86_64
  • A kernel exposing BTF at /sys/kernel/btf/vmlinux (default on most distro kernels since ~5.8 / 2021 — check with ls /sys/kernel/btf/vmlinux)
  • Root, or CAP_BPF + CAP_PERFMON, to run provctl watch (attaching eBPF probes requires it). The read-only subcommands (trace, timeline, ps) need no special privileges beyond read access to the database file.

From source

git clone https://github.com/thefoulowl/provctl
cd provctl
go build -o provctl ./cmd/provctl
sudo install -Dm755 provctl /usr/local/bin/provctl   # optional

No clang or bpftool needed for this — the compiled eBPF object and its Go bindings (internal/engine/probes_x86_bpfel.{go,o}) are committed to the repo. You only need the eBPF toolchain if you're modifying internal/bpf/provctl.bpf.c itself (see below).

Go 1.23+ is required (see go.mod).

Distro packages

Packaging (.deb, .rpm, and an Arch PKGBUILD) lives under packaging/ in the repo. See that directory's own README for exact build commands — once a tagged release exists, prebuilt packages will also be attached to the GitHub Releases page.

Rebuilding the eBPF probes

Only needed if you change internal/bpf/provctl.bpf.c:

# Fedora
sudo dnf install clang llvm libbpf-devel elfutils-libelf-devel bpftool
# Debian/Ubuntu
sudo apt install clang libbpf-dev bpftool

make generate   # regenerate vmlinux.h from your kernel's BTF, recompile,
                # regenerate internal/engine/probes_x86_bpfel.{go,o}
make build

make generate uses your running kernel's BTF to compile — that's fine, because CO-RE relocations are re-resolved at load time against whatever kernel provctl actually runs on. You don't need to compile on the exact same kernel version you'll deploy to.

Clone this wiki locally