DTrace vs eBPF — Vivian Voss
The Unix Way Episode 17. DTrace as the canonical answer to in-production tracing, designed at Sun by Bryan Cantrill, Mike Shapiro and Adam Leventhal in 2003, generally available in Solaris 10 from January 2005, ported to FreeBSD by John Birrell in 7.1-RELEASE on 6 January 2009. The principle: instrument any kernel or userland probe with zero overhead when disabled and minimal overhead when enabled, with a deliberately Turing-incomplete script language so the compiler can prove every probe terminates within bounded time and memory. The Linux licence wall: DTrace was released under the CDDL, a file-level weak copyleft that accepts coexistence with any other licence; the GPL is strong copyleft and demands that any combined work be relicensed to GPL. The asymmetry is structural; the block was in the GPL's design, not the CDDL's behaviour. The Linux rebuild: BPF was already there (McCanne and Jacobson, Berkeley, 1992); Alexei Starovoitov and Daniel Borkmann generalised it into eBPF, merged in Linux 3.18 on 7 December 2014; BCC by Brenden Blanco at IO Visor arrived in 2015; bpftrace by Alastair Robertson, announced by Brendan Gregg as 'DTrace 2.0 for Linux' in October 2018. The bridge figure is Brendan Gregg himself, co-author of the 2011 DTrace book with Jim Mauro at Sun/Joyent and of the 2019 BPF Performance Tools book at Netflix. The shape was always the same; the journey was a great deal longer.