---
name: "threadsnoop-bpfcc"
section: "8"
platform: "linux"
package: "bpfcc-tools"
version: "0.31.0+ds-7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/threadsnoop-bpfcc"
---

# threadsnoop-bpfcc(8)

Trace thread creation via pthread\_create(). Uses BCC/eBPF.

## NAME

threadsnoop - Trace thread creation via pthread\_create(). Uses BCC/eBPF.

## SYNOPSIS

**threadsnoop**

## DESCRIPTION

threadsnoop traces calls to pthread\_create(), showing this path of thread creation. This can be used for workload characterization and discovery, and is a companion to [execsnoop(8)](/execsnoop/8.md) which traces [execve(2)](/execve/2.md).

This works by tracing the pthread\_create() from libpthread.so.0. The path to this library may need adjusting in the tool source to match your system.

Since this uses BPF, only the root user can use this tool.

## REQUIREMENTS

CONFIG\_BPF and BCC.

## EXAMPLES

- Trace calls pthread\_create():

  \# **threadsnoop**

## FIELDS

- TIME(ms)

  Elapsed time since the tool began tracing (in milliseconds).

- PID

  The process ID.

- COMM

  The process (thread) name.

- FUNC

  The name of the start routine, if the symbol is available, else a hex address for the start routine address.

## OVERHEAD

Thread creation is expected to be low (\<\< 1000/s), so the overhead of this tool is expected to be negligible.

## SOURCE

This originated as a bpftrace tool from the book "BPF Performance Tools", published by Addison Wesley (2019):

-

  http://www.brendangregg.com/bpf-performance-tools-book.html

See the book for more documentation on this tool.

This version is in the BCC repository:

-

  https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHOR

Brendan Gregg

## SEE ALSO

[execsnoop(8)](/execsnoop/8.md)