brr is a tool that gives you bpftop-like initial listing of eBPF program activity, with the ability to then press ENTER for seeing the source code lines of a program and press "p" to profile the eBPF program using perf_events sampling.
It has both a plain-text, JSON, CSV CLI output mode and a top-like TUI mode. It lists loaded eBPF objects, measures program activity, maps CPU samples back to BPF source lines, and importantly also shows any kernel work triggered underneath eBPF programs.
brr talks directly to the kernel through bpf() and perf_event_open(). As it uses perf_events API directly, it does not depend on the perf command being installed.
Live program activity, execution rate, average runtime, and JIT size:
Source-level CPU attribution, including time spent in kernel functions called from the selected BPF program:
Expand a source line to see which kernel functions account for work underneath the BPF program:
Most commands require root or equivalent Linux capabilities. Published standalone binaries include Python and the application dependencies and require Linux with GLIBC 2.28 or newer.
ARM64 (aarch64):
curl -fL -o brr https://github.com/tanelpoder/brr/releases/download/v0.6.1/brr-0.6.1-linux-aarch64 && chmod +x brrx86-64 (x86_64):
curl -fL -o brr https://github.com/tanelpoder/brr/releases/download/v0.6.1/brr-0.6.1-linux-x86_64 && chmod +x brrRun it from the current directory or install it on PATH:
sudo ./brr
sudo install -m 0755 brr /usr/local/bin/brr
sudo brr| Platform | RPM | DEB |
|---|---|---|
| ARM64 | brr-0.6.1-1.el8.aarch64.rpm |
brr_0.6.1-1_arm64.deb |
| x86-64 | brr-0.6.1-1.el8.x86_64.rpm |
brr_0.6.1-1_amd64.deb |
The release also includes a combined
SHA256SUMS
manifest for all six binaries and packages.
Install a downloaded package with dnf or apt:
sudo dnf install ./brr-0.6.1-1.el8.aarch64.rpm
sudo apt install ./brr_0.6.1-1_arm64.debUse the matching x86-64 package name on Intel and AMD 64-bit systems.
Source checkouts require Linux, Python 3.11 or newer, and
uv.
git clone https://github.com/tanelpoder/brr.git
cd brr
uv sync
sudo env PATH="$PATH" uv run brrBuild the GLIBC 2.28-compatible standalone binary, RPM, and DEB natively for the current architecture with Docker or Podman:
scripts/build_rhel8_release.shFor a simpler build that targets the current host's GLIBC:
uv sync --group dev --group package
uv run --group package python scripts/build_release.py --allSee PACKAGING.md for release dependencies, compatibility checks, artifact verification, and the native multi-architecture GitHub release workflow.
Open the interactive TUI:
sudo brrList loaded programs and other BPF objects:
sudo brr prog
sudo brr map
sudo brr link
sudo brr btfMeasure activity or profile BPF JIT execution:
sudo brr activity --duration 2
sudo brr profile --duration 5
sudo brr profile --kernel-samplesUse brr --help or brr <command> --help for all options. Plain text, JSON,
and CSV output are available for scripting; the interactive TUI is also
available as deterministic text output with brr top --textmode.
- Loaded BPF programs, maps, links, BTF objects, JIT sizes, and pinned paths.
- Program execution counts, average runtime, CPU usage, and cumulative metrics.
- Translated BPF instructions annotated with source metadata when available.
- Perf samples attributed to BPF source lines and to helper or kernel functions running underneath them.
- Capture-loss and perf-buffer telemetry for judging profile completeness.
bpftool is optional and used only for explicit enrichment or comparison.
brr scopes runtime statistics with BPF_ENABLE_STATS and does not write to
/proc/sys/kernel/bpf_stats_enabled.
For richer text reports, see EXAMPLE_OUTPUT.md. For the
sampling methodology and measured comparisons with perf, see
Correctness validation against perf.
Profiling drilldown makes hash-map lookup and comparison costs visible:
Sleepable programs can expose user-memory access, page walking, and locking costs:
Queue-map pushes can reveal copying and lock contention below the calling BPF source line:
