bpftrace MCP Server

Demonstrations of killsnoop, the Linux bpftrace/eBPF version. This traces signals sent via the kill() syscall. For example: # ./killsnoop.bt Attaching 3 probes... Tracing kill() signals... Hit Ctrl-C to end. TIME PID COMM SIG TPID RESULT 00:09:37 22485 bash 2 23856 0 00:09:40 22485 bash 2 23856 -3 00:09:31 22485 bash 15 23814 -3 The first line showed a SIGINT (2) sent from PID 22485 (a bash shell) to PID 23856. The result, 0, means success. The next line shows the same signal sent, which resulted in -3, a failure (likely because the target process no longer existed). There is another version of this tool in bcc: https://github.com/iovisor/bcc The bcc version provides command line options to customize the output.