A toolkit for creating efficient kernel tracing and manipulation programs using extended BPF (eBPF) on Linux.
BCC (BPF Compiler Collection) is an open-source toolkit for creating efficient, safe programs that instrument the Linux kernel using extended BPF (eBPF). It provides libraries, compilers, and a suite of pre-built tools for dynamic tracing, performance analysis, network monitoring, and system observability. BCC solves the problem of deep kernel introspection without requiring kernel modules or risking system instability.
System administrators, performance engineers, kernel developers, and SREs who need to diagnose complex performance issues, monitor low-level system behavior, or implement custom network traffic control on Linux systems.
Developers choose BCC because it offers a safe, production-ready environment for BPF programming with a rich set of tools and Python bindings, eliminating the need to write risky kernel modules. Its integration with eBPF ensures programs are sandboxed and verified, while providing unparalleled visibility into kernel and application behavior.
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses eBPF's sandboxed virtual machine to run programs that 'can never crash, hang or interfere with the kernel negatively,' as cited from Ingo Molnár in the README, ensuring system stability during tracing.
Includes dozens of ready-to-use tools like opensnoop for file opens and biolatency for disk I/O latency, providing immediate value for performance troubleshooting across various subsystems.
Allows writing BPF programs in C with Python or Lua wrappers, lowering the barrier to kernel programming for developers familiar with scripting languages, as highlighted in the README.
Covers kernel tracing, network monitoring, storage analysis, and more, evidenced by the wide range of tools listed for CPU, memory, filesystems, and networking in the contents section.
BCC is strictly for Linux kernels 4.1 and above, as stated in the README, making it irrelevant for cross-platform or legacy system observability needs.
Installation can be challenging due to dependencies on specific kernel versions, headers, and LLVM, requiring users to follow separate INSTALL.md documentation rather than simple package installs.
Most tools require root or CAP_BPF privileges to load eBPF programs, limiting deployment in containerized or security-hardened environments without additional configuration.
Creating custom BPF programs demands deep knowledge of kernel internals and C, despite Python frontends; the README's tutorial links indicate this isn't for casual users.