Add option to follow forks

Author: not-matthiasCreated Nov 10, 2025Updated Jun 19, 2026

Is your feature request related to a problem? Please describe.

I have the following Rust Program:

rust

fn main() {
    let output = std::process::Command::new("bash")
        .arg("-c")
        .arg("sleep 2 && /nix/store/rry6qingvsrqmc7ll7jgaqpybcbdgf5v-coreutils-9.7/bin/ls -l")
        .spawn().unwrap();
    println!("Current PID: {}", std::process::id());
    println!("Child PID: {}", output.id());
    let output = output.wait_with_output().unwrap();

    println!("Output: {}", String::from_utf8_lossy(&output.stdout));
}

And I want to trace the memory allocations like this:

uretprobe:/nix/store/g8zyryr9cr6540xsyg4avqkwgxpnwj2a-glibc-2.40-66/lib/libc.so.6:malloc
{
    printf("Malloc called in pid %d\n", pid);
}

uprobe:/nix/store/g8zyryr9cr6540xsyg4avqkwgxpnwj2a-glibc-2.40-66/lib/libc.so.6:free
{
    printf("Free called in pid %d\n", pid);
}

However, when running this we're just seeing the mallocs/frees of the main executable:

bash

$ sudo bpftrace -c "target/debug/examples/subprocess" trace_mem.bt
Attached 2 probes
Malloc called in pid 2660444
Malloc called in pid 2660444
Malloc called in pid 2660444
Free called in pid 2660444
Free called in pid 2660444
Free called in pid 2660444
Malloc called in pid 2660444
Malloc called in pid 2660444
Free called in pid 2660444
Free called in pid 2660444
Free called in pid 2660444
Malloc called in pid 2660444
Malloc called in pid 2660444
Malloc called in pid 2660444
Malloc called in pid 2660444
Malloc called in pid 2660444
Malloc called in pid 2660444
Malloc called in pid 2660444
Free called in pid 2660444
Current PID: 2660444
Child PID: 2660451
Free called in pid 2660444
Free called in pid 2660444
Free called in pid 2660444
Free called in pid 2660444
Free called in pid 2660444
Malloc called in pid 2660444
total 84
drwxr-xr-x 2 not-matthias users  4096 Nov 10 19:17 benches
-rw-r--r-- 1 not-matthias users  7159 Nov 10 19:06 Cargo.lock
-rw-r--r-- 1 not-matthias users   220 Nov 10 19:07 Cargo.toml
drwxr-xr-x 2 not-matthias users  4096 Nov 10 19:17 examples
-rw-r--r-- 1 not-matthias users  2217 Nov 10 19:37 README.md
drwxr-xr-x 2 not-matthias users  4096 Nov 10 18:57 src
-rw-r--r-- 1 not-matthias users 37940 Nov 10 19:27 strace.txt
drwxr-xr-x 6 not-matthias users  4096 Nov 10 19:07 target
-rw-r--r-- 1 not-matthias users   273 Nov 10 19:49 trace_mem.bt
-rw-r--r-- 1 not-matthias users   539 Nov 10 19:05 trace_mem.original.bt
Output: 
Free called in pid 2660444
Free called in pid 2660444

Describe the solution you'd like

Another CLI option could be added that supports following forks like in strace:

  -f, --follow-forks
                 follow forks
  -ff, --follow-forks --output-separately
                 follow forks with output into separate files

Describe alternative solutions or features you've considered

I've tried not running with -c but then there are waaaay too many events which leads to many lost samples. Let me know if I missed something.

Source: bpftrace/bpftrace

View original on GitHub View discussion on GitHub