Field guide: the validation tools
Optional. The command-line tools we leaned on for validation all along — bpftrace, bpftool, and the BCC tools — and how to drive them from Python to turn one-liners into repeatable tools.
bpftrace from Python: one-liners into tools
bpftrace has been our cross-check all along — the awk-for-the-kernel one-liner we ran to confirm what an Aya program reported. This optional field-guide chapter turns that into a repeatable instrument: bpftrace emits newline-delimited JSON, so a small Python wrapper can run a program, parse the stream by event type, and render a live table or feed a metric — exploration on tap, without writing or compiling Aya.
bpftool from Python: inventory and audit
bpftool was our ground truth all book — prog show, map dump, link show, struct_ops register. It speaks JSON, so a small Python wrapper turns it into real tools: an inventory of every loaded program, a runtime 'top' of which BPF costs the most CPU, map dumps, attachment audits, and a kernel-feature summary. Several working examples you can run on any box.
The BCC tools: the ready-made suite
BCC ships the ~100 ready-made tracers whose names recur in every cross-check — execsnoop, biolatency, runqlat, tcpconnect, profile. This closing field-guide chapter tours them, explains the two generations (classic Python+C that compiles at runtime versus precompiled libbpf-tools CO-RE binaries), and drives them from Python: resolve a tool, run it, parse its columns into a summary. Several working examples, plus a minimal BCC program to show what a tool is underneath.