This project enables users to generate and execute eBPF programs for Linux tracing and analysis using natural language prompts, powered by ChatGPT. It targets developers, system administrators, and researchers who need to quickly instrument kernel behavior without deep eBPF expertise, offering a conversational interface for complex tracing tasks.

How It Works

GPTtrace translates natural language requests into eBPF programs by leveraging a vector database of eBPF examples and identifying kernel hook points. It constructs prompts for the GPT API, queries the database for relevant examples, generates the eBPF code, and attempts to load it into the kernel. If loading fails, it uses error messages to refine prompts and retries the process, providing explanations of the results.

Quick Start & Requirements

• Install via pip: pip install gpttrace
• Requires an OpenAI API key, set via the OPENAI_API_KEY environment variable or the -k flag.
• Usage example: python3 gpttrace "Count page faults by process"
• Official documentation and tutorials are available at https://github.com/eunomia-bpf/bpf-developer-tutorial.

Highlighted Details

• Generates eBPF programs from natural language descriptions.
• Can trace kernel events and explain the results using AI.
• Integrates with existing bpftrace tools and BCC commands.
• Includes a feedback loop for correcting eBPF program generation based on kernel loading errors.

Maintenance & Community

The project is associated with the eunomia-bpf organization. Further details on community or roadmap are not explicitly provided in the README.

Licensing & Compatibility

Licensed under the MIT license, permitting commercial use and integration with closed-source projects.

Limitations & Caveats

The project is explicitly stated as an experiment and not suitable for production use. Its effectiveness relies heavily on the quality of the underlying LLM and the provided examples, and it may require significant prompt engineering or iteration for complex tasks.