Hysen Labs
Open-source project
hitzhangjie/go-ftrace avatar
hitzhangjie

go-ftrace

bpf(2)-based ftrace(1) like function call graph for Go

26 stars3 forksCLicense varies
DEEP OPEN-SOURCE ANALYSIS

go-ftrace traces Go function calls with eBPF

go-ftrace is a function graph tracer for Go processes built on bpf(2), similar to ftrace(1). It inspects function calls, arguments, and return values on Linux x86-64.

What it can trace

The tool traces specific functions by name, such as main.add, and supports wildcards like main.add* to match several functions at once. It can trace multiple patterns in a single run and can target methods of a named type. With the --fargs and --frets flags you supply register expressions to read arguments at entry and return values at the function return point.

Automatic argument reading

For common Go types, including integers, pointers, strings, slices, interfaces, and pointers to structs, ftrace can derive the --fargs and --frets rules on its own from DWARF debug info. The README shows that a bare command such as sudo ftrace with a type method then fetches receiver and argument data without manual expressions.

Requirements and limits

The README limits support to Linux with bpf(2) and uprobe, on x86-64 little endian hardware. The target must be a non stripped Go ELF executable built in non PIE mode, and it must keep the .symtab and .(z)debug_info sections. A provided Makefile lets you run the example targets to try the tracer quickly.

Editorial conclusion

The tracer is written in C and works on Linux x86-64 against non stripped, non PIE Go binaries that carry their symbol and DWARF sections.

DEEP OPEN-SOURCE ANALYSIS

Official sources

Community notes

Community notes