ptop 1.1.0

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or CAP_BPF + CAP_PERFMON.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.1.0/ptop-1.1.0-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Features

• 1ca5536: feat(bpf): add namespace-aware target resolver (@trentas)
• 4a540b1: feat: add ebpf-selftest diagnostic tool (@trentas)

Bug fixes

• 445c80f: fix(bpf): namespace-aware pid filter for cpu collector (@trentas)
• 8766978: fix(bpf): namespace-aware pid filter for futex collector (@trentas)
• c8828a6: fix(bpf): namespace-aware pid filter for io collector (@trentas)
• bd2689b: fix(bpf): namespace-aware pid filter for memory collector (@trentas)
• 7e7a481: fix(bpf): namespace-aware pid filter for network collector (@trentas)
• 0d45e91: fix(bpf): namespace-aware pid filter for syscalls collector (@trentas)
• a679d61: fix(bpf): namespace-aware pid filter for threads collector (@trentas)

Collectors

• 2796ebe: collector: extract reusable Set for source selection + lifecycle (@trentas)
• c1813c0: collector: move internal/collector → pkg/collector (@trentas)

TUI

• 3a90186: tui: F3 network anomalies panel for net errors (#56) (@trentas)
• ecdb176: tui: decouple render from data ingestion + pprof flag (@trentas)
• 3d883d9: tui: detect the inspected process's runtime for the header badge (@trentas)
• 16551af: tui: report the real kernel version in the status bar, drop fake overhead (@trentas)

Other

• 89366d6: Fix formatting in README.md (@trentas)
• e3d27d6: Merge pull request #50 from trentas/fix/ebpf-pidns (@trentas)
• fd63032: Merge pull request #62 from trentas/macos-net-tx-rx (@trentas)
• 6b51b53: Merge pull request #65 from trentas/feat/collector-set-foundation (@trentas)
• 3820de5: Merge pull request #67 from trentas/feat/proto-schema (@trentas)
• b891abe: Merge pull request #68 from trentas/feat/pkg-collector (@trentas)
• 3a791c0: Merge pull request #69 from trentas/feat/serve-grpc (@trentas)
• 88b4287: Merge pull request #70 from trentas/feat/serve-sinks (@trentas)
• 3641b5a: Merge pull request #73 from trentas/feat/heap-malloc-pairing (@trentas)
• 99be88c: Merge pull request #74 from trentas/feat/heap-tui (@trentas)
• 2611130: Merge pull request #75 from trentas/feat/symbol (@trentas)
• 1f6adc1: Merge pull request #76 from trentas/feat/symbol-heap (@trentas)
• 74acf8e: Merge pull request #77 from trentas/feat/symbol-stream (@trentas)
• 0b84483: Merge pull request #78 from trentas/feat/net-errors (@trentas)
• 2ddad95: Merge pull request #79 from trentas/feat/net-errors-tui (@trentas)
• 6290853: Merge pull request #80 from trentas/feat/fs-semantics (@trentas)
• 94d1bc2: Merge pull request #81 from trentas/feat/signals (@trentas)
• b71bfbd: Merge pull request #82 from trentas/feat/tls-payload (@trentas)
• 47aa942: Merge pull request #83 from trentas/feat/proc-context (@trentas)
• f0e93d0: Merge pull request #84 from trentas/feat/proc-lineage (@trentas)
• d9c16f2: Merge pull request #85 from trentas/feat/security-events (@trentas)
• 368f63e: Merge pull request #86 from trentas/docs/refresh-after-epic-52 (@trentas)
• 17ae215: Merge pull request #87 from trentas/feat/threads-offcpu (@trentas)
• d8c5381: Merge pull request #88 from trentas/perf/tui-render-decouple (@trentas)
• 59ddb84: context: capture namespace/cgroup + uid/gid execution context (#60) (@trentas)
• ae6b9fd: docs(bpf): document threads root2ns/prune design decisions (@trentas)
• 4f92a28: docs(bpf): refresh stale cpu.bpf.c header comment (@trentas)
• 12102ef: docs(bpf): refresh stale syscalls.bpf.c map comment (@trentas)
• 9d5f6c2: heap: F1 live-heap panel — sparkline + top call sites + leak (#53) (@trentas)
• 157533b: heap: libc malloc/free pairing, live-heap + leak signal (#53) (@trentas)
• d3a5da0: io: capture filesystem semantics — denials, deletes, renames (#57) (@trentas)
• efa3db5: lineage: capture exec lineage (fork/exec/exit) via sched tracepoints (#60) (@trentas)
• bd2c8e7: macos: add Tier 1 port via libproc + Mach (closes #22) (@trentas)
• 5c1a35e: macos: audit cleanup — dead code, iowait bias, collector tests (@trentas)
• 815b83d: macos: fix F3 connection ordering and stop lying in the chrome (@trentas)
• f998d87: macos: surface socket Tx/Rx and add F3 TX/RX column (@trentas)
• 726c311: make: add install / install-ebpf / uninstall targets (@trentas)
• b8d94fb: network: capture RST/retransmit errors on the event stream (#56) (@trentas)
• c411241: proc.bpf.c: fix sched_process_fork field offsets (__data_loc comm) (@trentas)
• 6aa1325: refactor(ebpfselftest): run() pattern so tracer Close() always runs (@trentas)
• b5ef3e3: security: capture runtime PROT_EXEC mappings + LSM denials (#59) (@trentas)
• fdefd38: serve: StackRef on heap events + ResolveStack RPC (#54) (@trentas)
• 41a626b: serve: headless ptop --serve gRPC event stream server (@trentas)
• fcd47fe: serve: integration test for backpressure StreamMeta over gRPC (@trentas)
• 35de8b9: serve: rename service EventStream → EventStreamService (buf lint) (@trentas)
• 517ab62: serve: sink abstraction + JSONL export; close #51 (@trentas)
• 6f269ee: signal: capture signals delivered to the target, with origin (#58) (@trentas)
• 930b962: streampb: event stream protobuf schema + buf codegen (@trentas)
• 3a59a73: symbol: ELF/gosym symbolization core (pkg/symbol) (#54) (@trentas)
• 6947985: symbol: resolve heap call sites to func (file:line) (#54) (@trentas)
• ed4dea6: test(bpf): assert targetFilter field offsets (@trentas)
• 71cdd34: threads: surface per-thread off-CPU% in F4 (#61) (@trentas)
• 3a8adf6: tls: capture pre-encryption payload via libssl uprobes (#55) (@trentas)