---
id: 1810
title: "All your tracing are belong to BPF"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2021/11/09/all-your-tracing-are-belong-to-bpf/"
published_at: "2021-11-09T16:26:37Z"
tags: ["linux", "kernel", "tutorial", "observability", "tracing", "bpf"]
phying_url: "https://phying.com/item/1810"
lang: en
---

# All your tracing are belong to BPF

## Summary

A hands-on introduction to Linux BPF tracing without specialized tooling: event sources, dynamic and static instrumentation, plus maps and perf outputs, ending with a syscall-counting program.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2021-11-09T16:26:37Z
- **Original:** https://blog.trailofbits.com/2021/11/09/all-your-tracing-are-belong-to-bpf/
- **Phying News:** https://phying.com/item/1810