.TH threadsnoop 8  "2019-07-02" "USER COMMANDS"
.SH NAME
threadsnoop \- Trace thread creation via pthread_create(). Uses BCC/eBPF.
.SH SYNOPSIS
.B threadsnoop
.SH DESCRIPTION
threadsnoop traces calls to pthread_create(), showing this path of thread
creation. This can be used for workload characterization and discovery, and is
a companion to execsnoop(8) which traces execve(2).

This works by tracing the pthread_create() from libpthread.so.0. The path
to this library may need adjusting in the tool source to match your system.

Since this uses BPF, only the root user can use this tool.
.SH REQUIREMENTS
CONFIG_BPF and BCC.
.SH EXAMPLES
.TP
Trace calls pthread_create():
#
.B threadsnoop
.SH FIELDS
.TP
TIME(ms)
Elapsed time since the tool began tracing (in milliseconds).
.TP
PID
The process ID.
.TP
COMM
The process (thread) name.
.TP
FUNC
The name of the start routine, if the symbol is available, else a hex address
for the start routine address.
.SH OVERHEAD
Thread creation is expected to be low (<< 1000/s), so the overhead of this
tool is expected to be negligible.
.SH SOURCE
This originated as a bpftrace tool from the book "BPF Performance Tools",
published by Addison Wesley (2019):
.IP
http://www.brendangregg.com/bpf-performance-tools-book.html
.PP
See the book for more documentation on this tool.
.PP
This version is in the BCC repository:
.IP
https://github.com/iovisor/bcc
.PP
Also look in the bcc distribution for a companion _examples.txt file
containing example usage, output, and commentary for this tool.
.SH OS
Linux
.SH STABILITY
Unstable - in development.
.SH AUTHOR
Brendan Gregg
.SH SEE ALSO
execsnoop(8)