trace

Trace system activity using eBPF via bpftrace.

This module provides pre-built probes for common tracing scenarios without requiring bpftrace knowledge. For advanced use cases, custom bpftrace expressions can be provided.

Prerequisites

• bpftrace must be installed and available in PATH
• Root privileges (via become: true) are typically required

Return Values

When registered, the following fields are available:

• extra.events: List of captured events
• extra.stats.total: Total number of events
• extra.stats.by_comm: Event count grouped by command name
• extra.duration_ms: Actual trace duration in milliseconds

Attributes

check_mode:
  support: none

Parameters

Examples

Trace file opens during startup

- trace:
    probe: file_opens
    duration: 10s
  register: files

- debug:
    msg: "Files opened: {{ files.extra.events | length }}"

Trace process execution

- trace:
    probe: process_exec
    duration: 5s
  become: true
  register: procs

Filter syscalls

- trace:
    probe: syscalls
    filter: open,openat,read,write
    duration: 10s
  register: syscalls

Custom bpftrace expression

- trace:
    expr: 'tracepoint:syscalls:sys_enter_open { @[comm] = count(); }'
    duration: 10s
  become: true
  register: custom