ptop 1.9.0

ptop 1.9.0

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or five capabilities:

sudo setcap cap_bpf,cap_perfmon,cap_sys_admin,cap_dac_read_search,cap_sys_ptrace+ep ptop

cap_bpf,cap_perfmon alone — what these notes said until 1.6.0 — loads the
eBPF lane and then silently runs about three quarters of the probe set. The
remainder does not announce itself: the capture is well-formed and the
dropped axes publish zeros, and zero is a measurement (#117). Run
ptop --caps to see which collectors your privileges actually run.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.9.0/ptop-1.9.0-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

What changed — read before comparing captures across this release

The network axis now decides which sockets belong to the target by evidence, never by whichever task a softirq happened to interrupt (#135, #142). Measured against 1.8.1:

• a process owning no socket was credited with other processes' connections (192 in 15s on bare metal);
• a server's connections were never pruned;
• every client connection to one peer collapsed into one row, because SYN_SENT carries source port 0;
• the handshake RTT was never computed;
• connections opened before the capture never got bytes;
• on some kernel builds, rx read 0 for every connection.

Verified on the published arm64 binary against real targets (kernel 7.2 and 7.0 bare metal with an internet peer): bytes at 100.0% of ground truth, RTT within 0.06 ms of the application's own connect() time, and 0 connections credited to a socketless process. ebpf-selftest now checks all of it against a peer process.

On the wire:

• NetConn.latency_ms is optional. Absent means not measured (an accepted or pre-existing connection), never 0ms. Every latency_ms published by 1.8.1 and earlier was 0 and was not a measurement.
• NetConn.preexisting (new): the connection was open before the capture. Its bytes are measured, from the attach; a zero there is an idle connection.
• SyscallStat.latency_ns is exported: wall time summed over count, so latency_ns / count is the mean. It is optional. Syscall names now come from the kernel's own tables (#139).
• TargetInfo.ptop names the ptop that produced a stream: {version, commit, build_date} (#145). A capture from either side of these changes can now be told apart.

The network probe now reads socket addresses through the kernel's BTF, already a stated requirement. In Go, pkg/collector publishes []SyscallEvent instead of map[string]uint64.

Changelog

Other

• a5481db: Decide who owns a socket by evidence, and key it once it has a port (#135, #142) (@trentas)
• 0fc2ec7: Keep the project tree untouched, so this merges cleanly beside #144 (@trentas)
• 18ea5c1: Merge pull request #143 from trentas/fix/139-syscall-names-and-latency (@trentas)
• 4434ee9: Merge pull request #144 from trentas/fix/135-142-socket-ownership (@trentas)
• 4a0a212: Merge pull request #146 from trentas/feat/145-handshake-build-identity (@trentas)
• 44acd7e: Merge pull request #147 from trentas/fix/145-version-tag-form (@trentas)
• 064d970: Name syscalls from the kernel's own tables, and export the latency it already measures (#139) (@trentas)
• f1ce01c: Name the ptop that produced a stream in its handshake (#145) (@trentas)
• d112fe0: Spell a release's version like its tag in the handshake (#145) (@trentas)

ptop 1.8.1

ptop 1.8.1

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or five capabilities:

sudo setcap cap_bpf,cap_perfmon,cap_sys_admin,cap_dac_read_search,cap_sys_ptrace+ep ptop

cap_bpf,cap_perfmon alone — what these notes said until 1.6.0 — loads the
eBPF lane and then silently runs about three quarters of the probe set. The
remainder does not announce itself: the capture is well-formed and the
dropped axes publish zeros, and zero is a measurement (#117). Run
ptop --caps to see which collectors your privileges actually run.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.8.1/ptop-1.8.1-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• f8d8ad3: Merge pull request #141 from trentas/fix/140-seed-reads-target-netns (@trentas)
• d2f5060: Seed pre-existing connections from the target's socket tables, and say when it cannot (#140) (@trentas)

ptop 1.8.0

ptop 1.8.0

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or five capabilities:

sudo setcap cap_bpf,cap_perfmon,cap_sys_admin,cap_dac_read_search,cap_sys_ptrace+ep ptop

cap_bpf,cap_perfmon alone — what these notes said until 1.6.0 — loads the
eBPF lane and then silently runs about three quarters of the probe set. The
remainder does not announce itself: the capture is well-formed and the
dropped axes publish zeros, and zero is a measurement (#117). Run
ptop --caps to see which collectors your privileges actually run.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.8.0/ptop-1.8.0-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• 563f52f: Derive the bench's heap-only arm instead of keeping a copy of the list (@trentas)
• 72a0d0e: Drop CPU-panel columns instead of overflowing the box (@trentas)
• 36912fe: Export the two axes the panels already show (@trentas)
• 90f14d2: Feed the network panel from the published axis, not from the list (@trentas)
• 96a5a13: Fill the sparkline from the bottom, on both columns (@trentas)
• 40a713b: Give the CPU panel an address, under the number (#125) (@trentas)
• a794628: Give the CPU sampler its own column in the overhead table (@trentas)
• 1cbf29a: Keep the network byte totals when the connection leaves (#128) (@trentas)
• bf82af7: Keep the network byte totals when the connection leaves (#128) (@trentas)
• 07adb20: Make pause actually pause (@trentas)
• c75a33c: Match the CLAUDE.md note to the measurement (@trentas)
• da3240e: Measure a fixed-rate probe with the counter the kernel already keeps (@trentas)
• 067907b: Merge pull request #126 from trentas/feat/125-cpu-sample-attribution (@trentas)
• 55c899d: Merge pull request #127 from trentas/feat/125-cpu-attribution-wire (@trentas)
• ee54fc3: Merge pull request #129 from trentas/fix/128-monotonic-net-totals (@trentas)
• 1f21aa8: Merge pull request #130 from trentas/feat/125-cpu-sites-panel (@trentas)
• c6e5e35: Merge pull request #131 from trentas/fix/pause-freezes-the-display (@trentas)
• dfd6c4d: Merge pull request #132 from trentas/fix/export-path-is-unfindable (@trentas)
• 9b2517d: Merge pull request #134 from trentas/fix/133-prune-closed-connections (@trentas)
• d1b929e: Merge pull request #136 from trentas/fix/cask-postflight-steps (@trentas)
• 7446417: Merge pull request #138 from trentas/fix/137-share-and-map-module-images (@trentas)
• 900cb6e: Move cask quarantine stripping to postflight_steps (@trentas)
• 87e1e61: Never draw one direction of the network trend on its own (@trentas)
• e5710fc: Parse a binary once, and map its line table instead of copying it (#137) (@trentas)
• ad194e1: Prune spent connections, and count the short ones (#133) (@trentas)
• 004dd2c: Publish the CPU attribution axis, beside the nanoseconds (#125) (@trentas)
• bb88035: Refuse to draw below a minimum size, and stop overflowing above it (@trentas)
• f30586a: Sample the target's stacks, so the CPU axis can name a function (#125) (@trentas)
• 7c9480c: Say what an unresolved sample actually is, on the wire too (@trentas)
• e5b1050: Say what the 99Hz default was measured to do, not what it was assumed to (@trentas)
• 6586d32: Say where the export went (@trentas)
• 4276c02: Show network throughput as a trend, not only as a total (@trentas)
• 1787729: Stop the CPU axis asserting two things that are not true (@trentas)
• 8d4ff28: Tag the new axes so one object does not carry two naming conventions (@trentas)
• e4002ea: Unresolved samples are not a frame-pointer problem (@trentas)

ptop 1.7.3

ptop 1.7.3

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or five capabilities:

sudo setcap cap_bpf,cap_perfmon,cap_sys_admin,cap_dac_read_search,cap_sys_ptrace+ep ptop

cap_bpf,cap_perfmon alone — what these notes said until 1.6.0 — loads the
eBPF lane and then silently runs about three quarters of the probe set. The
remainder does not announce itself: the capture is well-formed and the
dropped axes publish zeros, and zero is a measurement (#117). Run
ptop --caps to see which collectors your privileges actually run.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.7.3/ptop-1.7.3-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• caa83f7: Compile the eBPF objects for the architecture that will run them (#123) (@trentas)
• 1aac398: Merge pull request #124 from trentas/fix/123-per-arch-bpf-objects (@trentas)

ptop 1.7.2

⚠️ The linux/arm64 binary in this release carries x86-built eBPF programs,
as does every release before it (#123). On arm64 that makes every uprobe
argument and return value garbage, silently — the probes still report
active. The amd64 binary is unaffected. Fixed in v1.7.3, the first
release whose arm64 binary carries arm64 objects.

ptop 1.7.2

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or five capabilities:

sudo setcap cap_bpf,cap_perfmon,cap_sys_admin,cap_dac_read_search,cap_sys_ptrace+ep ptop

cap_bpf,cap_perfmon alone — what these notes said until 1.6.0 — loads the
eBPF lane and then silently runs about three quarters of the probe set. The
remainder does not announce itself: the capture is well-formed and the
dropped axes publish zeros, and zero is a measurement (#117). Run
ptop --caps to see which collectors your privileges actually run.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.7.2/ptop-1.7.2-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• 484818c: Build release artifacts without a restored Go build cache (@trentas)

ptop 1.7.1

⚠️ The linux/arm64 binary in this release is broken — as it is in every
previous release. The eBPF objects are compiled once, on the x86_64 release
runner, and embedded into both the amd64 and the arm64 binary; on arm64 they
read struct pt_regs at x86 offsets, so every uprobe argument and return
value is garbage. The amd64 binary is unaffected. This is NOT specific to
v1.7.1, and the #121 fix this tag carries IS present in it.

(An earlier note here said the artifact lacked the fix. That was wrong — the
fix is in it; the arm64 eBPF objects are what is broken.)

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or five capabilities:

sudo setcap cap_bpf,cap_perfmon,cap_sys_admin,cap_dac_read_search,cap_sys_ptrace+ep ptop

cap_bpf,cap_perfmon alone — what these notes said until 1.6.0 — loads the
eBPF lane and then silently runs about three quarters of the probe set. The
remainder does not announce itself: the capture is well-formed and the
dropped axes publish zeros, and zero is a measurement (#117). Run
ptop --caps to see which collectors your privileges actually run.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.7.1/ptop-1.7.1-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• 9d118e9: Merge pull request #122 from trentas/fix/121-reserve-snapshot-room-in-collector-channels (@trentas)
• f8bcd99: Reserve room for the snapshot in a collector's own channel, not just upstream (#121) (@trentas)

ptop 1.7.0

ptop 1.7.0

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or five capabilities:

sudo setcap cap_bpf,cap_perfmon,cap_sys_admin,cap_dac_read_search,cap_sys_ptrace+ep ptop

cap_bpf,cap_perfmon alone — what these notes said until 1.6.0 — loads the
eBPF lane and then silently runs about three quarters of the probe set. The
remainder does not announce itself: the capture is well-formed and the
dropped axes publish zeros, and zero is a measurement (#117). Run
ptop --caps to see which collectors your privileges actually run.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.7.0/ptop-1.7.0-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• 200bd00: Merge pull request #118 from trentas/fix/117-capability-set-and-startup-probe-plan (@trentas)
• 27719e0: Merge pull request #120 from trentas/feat/119-symbols-for-stripped-binaries (@trentas)
• a648abc: Name a stripped third-party binary, by the build-id that already travels (#119) (@trentas)
• 0bf48c0: Say which collectors the capabilities actually run, and grant all five (#117) (@trentas)
• 03c61cb: The release notes stop teaching the setcap that drops three collectors (@trentas)

ptop 1.6.0

ptop 1.6.0

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or CAP_BPF + CAP_PERFMON.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.6.0/ptop-1.6.0-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• c1eebcc: Count the call-site cap in call sites, and say what the cut left out (#109) (@trentas)
• 88ee3d7: Merge pull request #116 from trentas/fix/109-fold-call-sites-and-report-completeness (@trentas)

ptop 1.5.0

ptop 1.5.0

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or CAP_BPF + CAP_PERFMON.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.5.0/ptop-1.5.0-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• c3b4c9a: Honour --disable on every lane a subsystem has, not just its eBPF one (@trentas)
• b2552a1: Merge pull request #114 from trentas/feat/probe-set-handshake (@trentas)
• 61e292e: Merge pull request #115 from trentas/fix/113-honour-disable-on-every-lane (@trentas)
• dd90a50: Say which collectors are running, so silence stops meaning "idle" (@trentas)
• 0e2bedb: Stop reporting io disabled when its /proc lane is running (@trentas)
• 3f98001: Stop the collector Sets the probe tests start (@trentas)

ptop 1.4.1

ptop 1.4.1

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or CAP_BPF + CAP_PERFMON.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.4.1/ptop-1.4.1-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• e904342: Measure the CPU axis in nanoseconds instead of sampling for it (@trentas)
• 82302d3: Merge pull request #111 from trentas/fix/cpu-axis-nanoseconds (@trentas)