tracing
Data source tracepoints: kernel static tracing kprobes: kernel dynamic tracing uprobes: user level dynamic tracing USDT / dtrace probes These tracepoints are hard coded in interesting and logical locations of the kernel, so that higher-level behavior can be easily traced. You can find all the tracepoints in include/trace/events/
Dynamic tracing can see everything, it’s also an unstable interface since it is instrumenting raw code.
cBPF used for filter. eBPF has (key/value) maps and more helper functions.