---
name: "threadsnoop.bt.bt"
section: "8"
platform: "linux"
package: "bpftrace"
version: "0.17.0-1"
release: "Debian 12 (Bookworm)"
platforms: ["linux"]
url: "https://new.carta.tech/threadsnoop.bt.bt"
---

# threadsnoop.bt.bt(8)

Trace thread creation via pthread\_create(). Uses bpftrace/eBPF.

## NAME

threadsnoop.bt - Trace thread creation via pthread\_create(). Uses bpftrace/eBPF.

## SYNOPSIS

**threadsnoop.bt**

## DESCRIPTION

threadsnoop traces calls to pthread\_create(), showing this path of thread creation. This can be used for workload characterization and discovery, and is a companion to [execsnoop.bt(8)](/execsnoop.bt/8.md) which traces [execve(2)](/execve/2.md).

This works by tracing the pthread\_create() from libpthread.so.0. The path to this library may need adjusting in the tool source to match your system.

Since this uses BPF, only the root user can use this tool.

## REQUIREMENTS

CONFIG\_BPF and bpftrace.

## EXAMPLES

- Trace calls pthread\_create():

  \# **threadsnoop.bt**

## FIELDS

- TIME(ms)

  Elapsed time since the tool began tracing (in milliseconds).

- PID

  The process ID.

- COMM

  The process (thread) name.

- FUNC

  The name of the start routine, if the symbol is available, else a hex address for the start routine address.

## OVERHEAD

Thread creation is expected to be low (\<\< 1000/s), so the overhead of this tool is expected to be negligible.

## SOURCE

This tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019):

-

  http://www.brendangregg.com/bpf-performance-tools-book.html

See the book for more documentation on this tool.

This version is in the bpftrace repository:

-

  https://github.com/iovisor/bpftrace

Also look in the bpftrace distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHOR

Brendan Gregg

## SEE ALSO

[execsnoop.bt(8)](/execsnoop.bt/8.md)