Repolode
Submit
jfernandez

jfernandez/bpftop

A terminal top-style monitor that shows running eBPF programs with their runtime, events per second, and estimated CPU usage.

View on GitHubWebsite
Stars
2,710
Forks
130
Open issues
5
Last commit
2 months ago

What is it?

bpftop gives a live, top-like view of every eBPF program loaded on a Linux host. For each program it shows the average runtime, events per second, and estimated share of total CPU, and it can plot these metrics over time in graphical views.

The tool turns on eBPF runtime statistics only while it is running and disables them on exit, so it adds little overhead when not in use. It requires root privileges and Linux kernel 5.8 or later, with older kernels handled through a procfs fallback.

It is written in C and ships as a single binary dynamically linked to libz and libelf. Install scripts are provided for x86_64 and aarch64, and packages are available for Fedora, Arch Linux, and Nix.

Key features

  • 01Lists all running eBPF programs with ID, type, and name.
  • 02Shows average runtime, events per second, and estimated CPU utilization per program.
  • 03Plots performance metrics over time in graphical views.
  • 04Supports arrow keys or vim-style j/k navigation, plus filtering and column sorting.
  • 05Shows the process names and PIDs that reference each eBPF program.
  • 06Refresh interval is configurable from 1 to 3600 seconds.

Use cases

  • Finding which eBPF programs consume the most CPU on a Linux server.
  • Diagnosing performance impact from tracing or networking tools built on eBPF.
  • Checking which processes hold references to a given eBPF program.

Quick start

  1. 1

    Run the official install script from the README

  2. 2

    Start bpftop with sudo

    sudo bpftop

Things to know

  • Requires sudo/root privileges to run.
  • Needs Linux kernel 5.8 or later, and libz and libelf must be present.

In collections

CLI & terminal toolsOpenTelemetry & observability platforms

Topics

#ebpf#linux#cli#monitoring#performance#observability#bpf

FAQ

What is bpftop?
A terminal top-style monitor that shows running eBPF programs with their runtime, events per second, and estimated CPU usage. bpftop gives a live, top-like view of every eBPF program loaded on a Linux host. For each program it shows the average runtime, events per second, and estimated share of total CPU, and it can plot these metrics over time in graphical views.
Is bpftop free to use? What license does it have?
bpftop is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is bpftop still maintained?
Updated within 6 months. The last commit to bpftop was on Sep 1, 2026.
What can I use bpftop for?
Finding which eBPF programs consume the most CPU on a Linux server. Diagnosing performance impact from tracing or networking tools built on eBPF. Checking which processes hold references to a given eBPF program.
How do I install bpftop?
Run the official install script from the README Start bpftop with sudo: sudo bpftop
Where can I get bpftop?
The source code and installation instructions are on GitHub: https://github.com/jfernandez/bpftop

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects