BCC: Frontend Tool for Getting Started With eBPF

In the previous article, we learned about the basic concepts of eBPF and a basic model for eBPF programming. Theoretically, with an understanding of these concepts, you should be able to write eBPF programs to track and debug some issues on the Linux system.

However, you might have noticed from the previous examples that compiling and running eBPF programs can be somewhat complex.

To make it easier to use eBPF programs for system tracking and debugging, the community has developed many frontend tools for eBPF. Among these tools, BCC (BPF Compiler Collection) provides the most comprehensive toolset and interfaces in Python, Lua, and C++ for developing eBPF tools. So today, let’s take a look at how to use BCC, the frontend tool for eBPF.

How to use BCC tools

BCC (BPF Compiler Collection) is a community project that started in 2015, roughly around the time when the kernel began supporting eBPF features. The goal of BCC is to provide a toolchain for writing, compiling, and loading eBPF programs into the kernel. Additionally, BCC offers a large collection of eBPF tools for Linux performance analysis and debugging.

Let’s try a few BCC tools to get a practical understanding of BCC. Most Linux distributions have BCC packages available for direct…