1
1
Fork
You've already forked proctrace
0
An eBPF-based profiler for process-lifecycle events.
  • Zig 90.2%
  • JSON 5.5%
  • Bluespec 3.7%
  • Shell 0.4%
  • C 0.2%
2025年11月27日 10:59:13 -07:00
.flox chore(flox): add zig-out/bin to PATH 2025年11月24日 17:32:33 -07:00
dev-docs feat: add dev docs, license, readme 2025年11月22日 18:58:08 -07:00
quint chore: add quint wip 2025年11月15日 11:54:08 -07:00
src feat: record remaining sys_exit events 2025年11月24日 18:52:25 -07:00
.gitignore fix: read user mem instead of kernel mem 2025年11月18日 15:46:37 -07:00
build.zig feat: record when observing a clone 2025年11月24日 17:12:37 -07:00
build.zig.zon feat: initial commit 2025年10月26日 17:38:00 -06:00
LICENSE Initial commit 2023年04月11日 09:46:45 +08:00
README.md chore: update readme 2025年11月27日 10:59:13 -07:00

proctrace

This is a WIP rewrite of a previous iteration of proctrace.

Differences:

  • Written in Zig instead of Rust.
  • Builds and uses a custom eBPF program rather than parsing the output of a custom bpftrace script.

About

proctrace is a high level profiler for process lifecycle events such as fork, exec, setpgid, and setsid.

This was created as a debugging tool for work on Flox.

macOS support isn't planned due to a hardware bug that causes macOS to hang if DTrace is run if machine has gone to sleep since boot. See this thread for details.

Progress

This is a work in progress, but here's a list of what's complete and what's planned:

  • Build at all
  • [BPF] Report syscall entry events
  • [BPF] Report syscall exit events
  • [BPF] Report diagnostics
  • [Userspace] Collect events
  • [Userspace] Collect errors and diagnostics
  • [Userspace] Construct the process tree
  • [Userspace] Report the process tree as JSON
  • [Userspace] Report the process tree in Perfetto Protobuf format

If you'd like to pitch in, see the dev docs.

License

Licensed under GPLv3.