---
name: "pidpersec.bt"
section: "8"
platform: "linux"
package: "bpftrace"
version: "0.27.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/pidpersec.bt"
---

# pidpersec.bt(8)

Count new processes (via fork()). Uses bpftrace/eBPF.

## NAME

pidpersec.bt - Count new processes (via fork()). Uses bpftrace/eBPF.

## SYNOPSIS

**pidpersec.bt**

## DESCRIPTION

pidpersec shows how many new processes were created each second. There can be performance issues caused by many short-lived processes, which may not be visible in sampling tools like [top(1)](/top/1.md). pidpersec provides one way to investigate this behavior.

This works by tracing the tracepoint:sched:sched\_process\_fork tracepoint.

Since this uses BPF, only the root user can use this tool.

## REQUIREMENTS

CONFIG\_BPF and bpftrace.

## EXAMPLES

- Count new processes, printing per-second summaries until Ctrl-C is hit:

  \# **pidpersec.bt**

## FIELDS

- 1st

  Count of processes (after "@")

## OVERHEAD

This traces kernel forks, and maintains an in-kernel count which is read asynchronously from user-space. As the rate of this is generally expected to be low (\<\< 1000/s), the overhead is also expected to be negligible.

## SOURCE

This is from bpftrace.

-

  https://github.com/bpftrace/bpftrace

Also look in the bpftrace distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

This is a bpftrace version of the bcc tool of the same name. The bcc tool may provide more options and customizations.

-

  https://github.com/iovisor/bcc

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHOR

Brendan Gregg

## SEE ALSO

[top(1)](/top/1.md)