Show HN: xstack – Passive eBPF Linux stack profiling without tracepoints
9 days ago
- #profiling
- #Linux
- #eBPF
- xstack is a lightweight, passive stack profiler for Linux using eBPF task iterators.
- It samples thread states and stack traces without injecting tracepoints, kprobes, or perf events.
- xstack can read both kernel and userspace stacks where frame pointers are available.
- It enables full wall-clock time profiling without impacting critical application processes.
- The tool has minimal overhead as it reads from shared physical memory without interrupts.
- xstack can be used with flamelens to generate terminal flamegraphs from sampled data.
- Example usage includes sampling all tasks, specific processes, or threads at various frequencies.
- The tool is part of the 0x.tools repository and is a short, simple C program.
- Upcoming tools like xtop will integrate xstack for dimensional performance analysis.