BCC, the BPF Compiler Collection, is a toolkit for creating efficient kernel tracing and manipulation programs built on extended BPF (eBPF), a sandboxed bytecode execution feature available in Linux 3.15 and later. The project provides both a compiler infrastructure and a comprehensive suite of ready-to-use tools for performance analysis, network monitoring, and system observability. BCC simplifies eBPF program development by offering kernel instrumentation capabilities in C with LLVM integration, alongside Python and Lua front-ends, making it accessible for tasks ranging from performance analysis to network traffic control.
The repository contains extensive tracing examples and production tools organized into multiple categories. Tracing examples include bitehist.py for block I/O size histograms, disksnoop.py for measuring block device I/O latency, and specialized probes for application-level tracing such as mysqld_query.py and nodejs_http_server.py using USDT probes. Additional examples cover TCP connection tracing, VFS read latency distribution, KVM hypercall monitoring, and kernel stack trace collection. The tools section provides mature utilities like argdist for parameter value histograms, bashreadline for system-wide bash command capture, and capable for security capability check tracing.
The toolkit includes specialized tools for memory and process monitoring such as memleak for detecting memory leaks, execsnoop for tracing process creation, exitsnoop for process termination events, and oomkill for out-of-memory killer tracking. Performance analysis tools like slabratetop monitor kernel memory cache allocation rates, while funccount and stackcount enable function call counting with optional stack trace collection. Additional capabilities include deadlock detection, error injection with predicates, mutex lock statistics via klockstat, and direct reclaim event tracing through drsnoop.
According to GitGenius activity tracking, the repository maintains active engagement with a median issue and pull request response latency of 56.7 hours across 215 tracked items, though mean latency extends to 2687.9 hours reflecting occasional longer-running discussions. The most frequently applied issue labels are help wanted, enhancement, and documentation, indicating ongoing community support needs and feature development. Primary contributors tracked by GitGenius include yonghong-song with 93 recorded events, chenhengqi with 67 events, and ekyooo with 46 events, demonstrating sustained core team involvement.
The repository maintains connections with other projects through overlapping contributors, linking to github/gh-aw, solo-io/gloo, and microsoft/vscode. BCC is classified across multiple technical domains including eBPF, kernel tracing, performance analysis, system observability, dynamic tracing, profiling, debugging, and runtime monitoring. The toolkit's primary language is C, reflecting its focus on kernel-level instrumentation where performance and direct hardware access are critical. Installation documentation is provided through INSTALL.md with platform-specific guidance, while FAQ.txt addresses common troubleshooting scenarios and a reference guide documents the BCC and BPF APIs for developers building custom instrumentation tools.
