Skip to main content
The userspace section provides information about userspace probe points where events are captured.

​
Fields

​
probe_type
string
required
Type of userspace probe. Currently only "usdt" (User-level Statically Defined Tracing) is supported.
​
symbol
string
required
Symbol name of the USDT probe that generated the event.Example: "http__server__request", "mysql__query__start"
​
ip
u64
required
Instruction pointer - the memory address of the symbol associated with this event.This is the actual address where the probe fired in the process’s address space.
​
path
string
required
Full filesystem path to the binary (executable or shared library) containing the probe.Example: "/usr/bin/node", "/usr/lib/libmysqlclient.so.21"
​
pid
i32
required
Process ID of the process where the probe fired.
​
tid
i32
required
Thread ID of the thread where the probe fired.For single-threaded processes, this typically equals the PID.

​
Display Format

The userspace section is displayed as: 
[u] {symbol} ({binary_name})
Where binary_name is extracted from the last component of path.

​
Example

[u] http__server__request (node)
[u] mysql__query__start (mysqld)

​
Example JSON

​
Node.js HTTP Probe

{
  "userspace": {
    "probe_type": "usdt",
    "symbol": "http__server__request",
    "ip": 140737353940123,
    "path": "/usr/bin/node",
    "pid": 5678,
    "tid": 5680
  }
}

​
MySQL Query Probe

{
  "userspace": {
    "probe_type": "usdt",
    "symbol": "mysql__query__start",
    "ip": 140737488347856,
    "path": "/usr/sbin/mysqld",
    "pid": 1234,
    "tid": 1234
  }
}

​
Multi-threaded Application

{
  "userspace": {
    "probe_type": "usdt",
    "symbol": "worker__job__start",
    "ip": 140737353940456,
    "path": "/opt/app/myapp",
    "pid": 9999,
    "tid": 10003
  }
}

​
When This Section Appears

The userspace section is present when:
  • Events are captured from USDT probes in userspace applications
  • Applications are instrumented with USDT probes
  • Retis is configured to attach to userspace probe points
This is mutually exclusive with the kernel section - an event will have either kernel or userspace, never both.

​
USDT Probes

USDT (User-level Statically Defined Tracing) probes are static tracepoints embedded in application binaries. They allow observing application behavior without modifying code. Common applications with USDT probes:
  • Node.js: HTTP requests, GC events, V8 operations
  • MySQL/PostgreSQL: Query execution, connection events
  • Python: Function calls, GC events (when compiled with USDT support)
  • Ruby: Method calls, object allocation
USDT probes must be compiled into the application. Use readelf -n <binary> or tplist-bpfcc -l <binary> to list available probes.

Build docs developers (and LLMs) love

Get started for freeTalk to us