bpftrace Dynamic Linux Kernel & Userspace Tracing

---
name: "bpftrace-dynamic-tracing-scripts"
description: "Write custom one-liner eBPF tracing probes for kernel functions, tracepoints, and uprobes."
metadata:
  author: "bpftrace"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "write bpftrace one liner"
  - "trace syscall latency bpftrace"
  - "attach uprobe bpftrace"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# bpftrace Dynamic Linux Kernel & Userspace Tracing

Authors dynamic probes with bpftrace: attaching to kprobes, tracepoints (syscalls:sys_enter_*), uprobes on user binaries, measuring function latency with hist(), and inspecting function arguments without restarting services.

## When to Invoke
Invoke this skill whenever you need to:
- write bpftrace one liner
- trace syscall latency bpftrace
- attach uprobe bpftrace

## Execution SOP & Rules
1. Run syscall histogram: bpftrace -e 'tracepoint:syscalls:sys_enter_read { @start[tid] = nsecs; } tracepoint:syscalls:sys_exit_read /@start[tid]/ { @dist = hist((nsecs - @start[tid]) / 1000); delete(@start[tid]); }'.
2. List available tracepoints: bpftrace -l 'tracepoint:syscalls:*'.
3. Attach to user process: bpftrace -e 'uprobe:/bin/bash:readline { printf("cmd entered\n"); }'.
4. Ensure clean exit on Ctrl-C and inspect aggregated maps output.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.