Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
7 bpftrace Alternatives for Linux Tracing in 2026
bpftrace is unbeatable for a one-liner, but the moment the trace is not the deliverable you need something more. Seven bpftrace alternatives compared, and why a runtime like yeet is the one that covers the most ground: a real userspace language, no toolchain on the host, enforcement, and a running interface, all at once.
See Every Process a Command Starts on Linux in 2026: My Honest Review of execsnoop
execsnoop hands you a firehose: one line per execve(), host-wide, perfect for grep and unreadable when you read it yourself. An honest review of where that shape stops working, and the execve-only and 20-argument limits behind it.
bpftrace vs BCC in 2026: Which One to Start Your eBPF Project With
Start with bpftrace unless your project already needs flags, floating-point math, or hosts with no compiler on them, in which case start with BCC. A side-by-side review of what each one installs, what each one refuses to do, the 512-byte stack limit that ends a bpftrace script, and how to tell today which one you will outgrow.