How I ended up writing opensnoop in pure C using eBPF
My biggest grievance with BCC has been, as noted in the article, that it requires LLVM to be linked in. Also, it requires a Python interpreter on the target machine. I've also wondered why eBPF can't be pre-compiled.Installing those dependencies on a regular PC is easy, but not so on an embedded system. I tried cross-compiling the dependencies once, but got stuck at some point. It would've been hard to justify the time spent if I'd continued, so I dropped it. I'm really happy that someone has invested time into this issue.