Simplify Probe Arguments Syntax

[zz85]

instead of --uprobe / --kprobe etc, use the syntax similar to bcctools trace/profile or even bpftool

[zz85]

BpfTrace

In bpftrace, you specify the type of instrumentation by starting the probe definition with a provider name (like kprobe or uprobe), followed by a colon-separated list of options.

Core Probe Types and Syntax
Probe Type Syntax Pattern Description
kprobe kprobe:function_name Dynamic kernel function entry.
kretprobe kretprobe:function_name Dynamic kernel function return.
uprobe uprobe:path:function_name Dynamic user-level function entry (binary or library).
uretprobe uretprobe:path:function_name Dynamic user-level function return.
tracepoint tracepoint:category:event Static kernel instrumentation points.
usdt usdt:path:probe_name User-level statically defined tracing.

Shorthand Aliases: Most providers have a single-letter alias to save space. For example, k: is identical to kprobe:, u: for uprobe:, and t: for tracepoint:.
Argument Access:
For kprobe, uprobe, and usdt, use the arg0, arg1, ... argN format to access function arguments directly from registers.
For tracepoint, use the args struct (e.g., args.filename) to access statically defined fields.
Wildcards: You can use wildcards (e.g., kprobe:vfs_*) to attach to multiple matching probes at once.
Return Values: When using kretprobe or uretprobe, you can access the function's return value using the retval builtin variable.

Examples
Kernel Tracepoint:
bpftrace -e 'tracepoint:syscalls:sys_enter_open { printf("%s %s\n", comm, str(args.filename)); }'
User Dynamic Probe (uprobe):
bpftrace -e 'uprobe:/bin/bash:readline { printf("readline called\n"); }'
Kernel Dynamic Probe (kprobe):
bpftrace -e 'kprobe:do_nanosleep { printf("%d sleeping\n", pid); }'
USDT Probe:
bpftrace -e 'usdt:/usr/bin/postgres:query_plan_start { ... }'

[zz85]

In Bcc-tools

The trace tool uses a short prefix before the probe target to identify the type:

kprobe (Kernel Dynamic): Use p: followed by the kernel function name. If the prefix is omitted, p: is the default.
Syntax: trace 'p::vfs_read' (traces the entry of vfs_read).
kretprobe (Kernel Return): Use r: followed by the kernel function name.
Syntax: trace 'r::vfs_read "ret=%d", retval' (traces the return value of vfs_read).
uprobe (Userspace Dynamic): Use p:library:function.
Syntax: trace 'p:c:malloc' (traces malloc in libc).
tracepoint (Kernel Static): Use t: followed by the category and event name.
Syntax: trace 't:block:block_rq_complete' (traces block I/O completion).
USDT (Userspace Static): Use u: followed by the library (or PID) and the probe name.
Syntax: trace 'u:node:gc_start' (traces Node.js garbage collection start).

Specifying Probes in profile
The profile tool primarily samples CPU stacks, but you can use the -I or -K flags to profile specific events instead of time-based sampling:
By default, profile performs timed sampling of stack traces across the CPU.
Specific Events: You can pass a probe string similar to trace to count stack traces whenever that specific event occurs.
Syntax: profile -I 't:block:block_rq_complete' (profiles stack traces triggered by the block I/O tracepoint).
Summary Table of Prefixes
Probe Type Prefix Example Target Scope
kprobe p: p::vfs_read Kernel Function Entry
kretprobe r: r::vfs_read Kernel Function Return
uprobe p: p:c:malloc Userspace Function Entry
tracepoint t: t:sched:sched_switch Static Kernel Event
USDT u: u:bash:entry Static Userspace Event
Note: For USDT and tracepoints, you can use the tplist tool included with BCC to find the exact names and arguments available for your system.

[zz85]

Perf Tools

You generally use perf list to find existing events and perf probe to define new ones.

1. Tracepoints are predefined hooks compiled into the kernel.

Format: category:event_name
How to Specify: Use directly in perf record or perf stat.
Example: perf record -e syscalls:sys_enter_execve -a
2.
3. Kprobes (Dynamic Kernel Tracing) Kprobes allow you to hook into almost any kernel function at runtime.
Oracle Blogs
Oracle Blogs
Step 1 (Define): Use perf probe to add a new event.
perf probe --add 'kernel_function_name'
Step 2 (Record): Once added, it appears in perf list under the probe category.
perf record -e probe:kernel_function_name -a

3. Uprobes (Dynamic User-Space Tracing)
   Uprobes are the user-space equivalent of kprobes, targeting functions in binaries or libraries.
   Step 1 (Define): Specify the path to the executable and the function name.
   perf probe -x /path/to/bin 'function_name'
   Step 2 (Record): Record the newly created probe event.
   perf record -e probe_bin:function_name -p

4. USDT (User Statically-Defined Tracing) USDT probes are predefined markers in user-space code, similar to tracepoints but for applications (e.g., MySQL, Python). eBPF Docs
   eBPF Docs

Step 1 (Register): You must often register the binary's build ID in the perf cache first.
perf buildid-cache --add /path/to/bin
Step 2 (Define): Use perf probe with the % prefix to target SDT (Static Defined Tracing) events.
perf probe -x /path/to/bin --add '%provider:event'
Step 3 (Record):
perf record -e sdt_provider:event -p

Summary Table
Probe Type Mechanism Specification Syntax Use Case
Tracepoint Static category:event Stable kernel events (e.g., syscalls)
Kprobe Dynamic perf probe function Any kernel function entry/exit
Uprobe Dynamic perf probe -x /bin function Any user-space function
USDT Static perf probe -x /bin %event Predefined app-level markers