Open-Source Observability · tanelpoder

0xtools

0x.Tools is a Linux performance analysis and troubleshooting toolkit built with modern eBPF, providing kernel-level visibility into system behavior. It includes xCapture for continuous sampling and xtop for interactive dimensional analysis, requiring Linux kernel 5.11+ and root privileges to operate.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/tanelpoder/0xtools

1.8k

GitHub stars

134

Forks

Python

Primary language

GPL-2.0

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	tanelpoder/0xtools
Owner	tanelpoder
Primary language	Python
License	GPL-2.0 — OSI-approved
Stars	1.8k
Forks	134
Open issues	16
Latest release	v3.0.3 (2025-10-23)
Last updated	2025-11-25
Source	https://github.com/tanelpoder/0xtools

What 0xtools is

xCapture v3 uses libbpf, CORE, BTF, and BPF task iterators to perform efficient kernel-space thread sampling and syscall/IO tracking, outputting dimensional data to CSV files for analysis without requiring ongoing root access. xtop provides a TUI-based dimensional query interface over DuckDB-backed CSV data, with minimal CPU overhead (~0.01–2% single CPU depending on system scale).

Quickstart

Get the 0xtools source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/tanelpoder/0xtools.git2cd 0xtools3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Continuous Linux Performance Monitoring at Scale

Capture system-wide thread activity, syscall patterns, and I/O events with sub-second sampling frequency and minimal overhead. Export to CSV for long-term retention and post-hoc analysis without re-instrumentation.

Kernel-Level Performance Troubleshooting

Investigate CPU scheduling, thread state transitions, and latency anomalies using eBPF-driven sampling. Access kernel events directly without legacy sampling limitations or bcc/bpftrace runtime overhead.

Dimensional Analysis of System Behavior

Query and pivot captured performance data by thread, syscall type, I/O pattern, and custom dimensions using DuckDB and xtop. Decouple data collection (root, kernel-space) from analysis (any user, userspace).

Implementation considerations

Verify kernel version (5.11+ required; RHEL9 5.14+, Oracle UEK7 5.15+, Ubuntu 20.04+ HWE) and eBPF support (BTF, CORE, task iterators) before deployment; mismatches will cause eBPF program load failures.
Run xcapture with elevated scheduling priority (e.g., `chrt -r 30`) and consider CPU affinity to minimize sampling jitter; 1 Hz default wakeup is tunable but consistency depends on userspace scheduler behavior.
Allocate storage for CSV output based on sampling rate, thread count, and retention window; dimensional data grows linearly with active thread count and collection duration.
Separate collection (root, real-time priority) from analysis (unprivileged user, DuckDB queries) to align with least-privilege security posture and enable decentralized post-hoc investigation.
Test eBPF program loading and ringbuf throughput on target hardware; large NUMA systems (e.g., 384 CPUs) may require tuning to avoid buffer overflow or sampling delays.

When to avoid it — and what to weigh

Legacy Kernel Deployments (<5.11) — xCapture v3 requires Linux 5.11+ for eBPF task storage. Older RHEL/Oracle UEK systems need a stripped-down build ('make old') with limited functionality; consider bcc or bpftrace alternatives if kernel upgrade is infeasible.
Non-Root or Containerized-Only Environments — xCapture collection requires root privileges to load eBPF programs. If kernel-space instrumentation is forbidden or multi-tenant container isolation is required, alternatives like perf, systemtap, or vendor APM tools may be necessary.
Real-Time or Predictable Latency Requirements — While CPU overhead is low, xCapture sampling is driven by userspace wakeups scheduled at 1 Hz. Applications requiring sub-millisecond, guaranteed response times should verify sampling jitter is acceptable or use lower-overhead profilers.
Production Systems Without Capacity for Testing — xCapture is actively maintained but v3 is recent (Oct 2025). Deployment to critical production without prior staging and validation on representative kernel/workload combinations carries risk of unknown interactions.

License & commercial use

Licensed under GPL-2.0 (GNU General Public License v2.0). This is a copyleft license requiring that any derivative works or software linked with 0x.Tools must also be distributed under GPL-2.0 or a compatible license.

GPL-2.0 is a copyleft license. Use as a tool to monitor and analyze systems internally is permissible, but redistribution, modification, or incorporation into proprietary software requires release of source code under GPL-2.0 terms. Commercial support, warranty, or licensing exceptions are not evident from available data. Requires legal review before embedding in closed-source commercial products or SaaS platforms.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Adequate
License clarity	Clear
Deployment complexity	Moderate
DEV.co fit	Good
Assessment confidence	High

Security considerations

xCapture requires root to load eBPF programs and access kernel memory; restrict execution to trusted operators. eBPF programs are compiled locally and loaded at runtime—verify source integrity and kernel BTF/CORE versions to prevent load failures or unexpected behavior. CSV output contains raw thread/syscall data; apply access controls to output directories per least-privilege policy. No security audit, fuzzing, or CVE data is available; treat as research-grade tooling pending production hardening review.

Alternatives to consider

Linux perf (perf-tools)

Built-in kernel profiler with lower setup overhead and wider hardware support; lacks dimensional query interface and requires root for collection, but mature and battle-tested in production.

bpftrace

Lightweight eBPF scripting language for ad-hoc instrumentation; more flexible for custom events but steeper learning curve and less suitable for continuous long-term data collection.

Observability vendors (Datadog, New Relic, Grafana Cloud)

Managed APM/observability platforms with pre-built eBPF and kernel profiling; higher cost and vendor lock-in but eliminate deployment and maintenance burden for enterprises.

Software development agency

Build on 0xtools with DEV.co software developers

Assess kernel requirements, deployment overhead, and GPL-2.0 licensing implications with our technical team to determine fit for your production environment.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

ngxtop neohtop kubetools

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source Observability DevOps & Infrastructure Observability Custom Software Development Talk to DEV.co

0xtools FAQ

Do I need root to analyze the CSV output?

No. Only xCapture collection requires root to load eBPF programs. CSV analysis via xtop or custom queries can be performed by any user with read access to the output directory, enabling separation of duties.

What is the minimum kernel version and why?

Linux 5.11+ is required for eBPF task storage. v3 uses modern eBPF features (CORE, BTF, task iterators) introduced in 5.11; older kernels require the 'make old' build with reduced functionality.

How much CPU overhead does xCapture add?

Approximately 0.01–2% of a single CPU, depending on system scale and thread count. Sampling loop takes ~100 µs on small systems to ~20 ms on large NUMA (384 CPU) systems at 1 Hz frequency.

Can I use 0x.Tools in a proprietary product?

Not without GPL compliance. GPL-2.0 requires source release for derivative works. Internal monitoring is permissible; commercial redistribution or embedding in closed-source software requires legal review and likely source code release or licensing exceptions.

Custom software development services

From first prototype to production, DEV.co delivers software development services around tools like 0xtools. Our software development agency staffs experienced software developers and web developers for custom software development, web development, integrations, and ongoing support across open-source observability and beyond.

Evaluate 0x.Tools for Your Infrastructure

Assess kernel requirements, deployment overhead, and GPL-2.0 licensing implications with our technical team to determine fit for your production environment.

Talk to DEV.co Schedule a Consultation