BCC review
A broad, self-hosted eBPF toolkit for engineers building custom Linux observability.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
BCC is an open-source toolkit for developing and running eBPF-based Linux tracing programs. It is aimed at engineers who need to investigate kernel and application behavior, build custom instrumentation, or use focused command-line tools for troubleshooting and performance analysis. The toolkit runs on Linux systems, including Debian, Ubuntu, Fedora, Arch, Gentoo, openSUSE, RHEL, Amazon Linux, Alpine Linux, and WSL, with installation through distribution packages or from source.
Its main strength is breadth across low-level observability. BCC supports kprobes, kretprobes, tracepoints, raw tracepoints, and kfuncs for kernel tracing, alongside uprobes, uretprobes, and USDT probes for user-space tracing. Engineers can examine system calls and processes, analyze disk I/O, filesystems, cache behavior, and latency, inspect network connections and retransmissions, instrument sockets, raw packets, and XDP, and perform CPU stack sampling or memory-allocation leak analysis. C-based instrumentation and Python or Lua front ends provide multiple ways to create and run programs.
BCC is a strong fit when control, Linux visibility, and custom eBPF development matter more than a packaged monitoring workflow. Its self-hosted model gives teams responsibility for installation, execution, output handling, and ongoing maintenance. The available output APIs—histograms, maps, perf buffers, and ring buffers—support different collection patterns, but they also assume engineering familiarity with eBPF and the surrounding Linux environment. Teams seeking hosted dashboards, managed operations, or an integrated observability ecosystem should choose a different type of product. BCC suits practitioners who want direct access to Linux tracing mechanisms and the flexibility to shape their own tools.
BCC pros and cons
- Where it wins
- Covers kernel, user-space, syscall, network, I/O, profiling, and memory analysis
- Supports C instrumentation with Python and Lua front ends
- Offers histogram, map, perf-buffer, and ring-buffer output APIs
- Where it doesn't
- Linux-focused and self-hosted rather than a hosted observability service
- Requires custom development and operational ownership
- Does not provide a managed observability experience or broad integrations
BCC fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update