whytime

About

whytime wraps a Linux command or attaches to a running process and uses eBPF to trace it and its children. It splits the wall-clock time along the critical path into shares such as on-CPU, fsync, network waits by hostname, locks and timer sleeps, and the shares always add up to 100%. It follows whichever task woke a waiting thread, so the top line shows what to speed up for the command to finish sooner.