error: unknown target triple 'unknown'

[hunanchenxingyu]

I successfully compiled bpftrace using the following method:

$ ./scripts/build-docker-image.sh && ./scripts/run-docker-build-env.sh
$ make bpftrace STATIC_LINKING=true LLVM_BPF_ONLY=true NDK_ARCH=arm64 BUILD_TYPE=Release

the information of bpftrace is as follows:

$ file out/android/arm64/bin/bpftrace
out/android/arm64/bin/bpftrace: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /system/bin/linker64, BuildID[sha1]=cce10138c4fd29d85c8a0563f76541ae8977cfb5, stripped

$readelf -d out/android/arm64/bin/bpftrace
Dynamic section at offset 0x4b25e98 contains 26 entries:
Tag Type Name/Value
0x0000000000000001 (NEEDED) Shared library: [libdl.so]
0x0000000000000001 (NEEDED) Shared library: [libm.so]
0x0000000000000001 (NEEDED) Shared library: [libz.so]
0x0000000000000001 (NEEDED) Shared library: [libc.so]
0x000000000000001e (FLAGS) BIND_NOW
0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
.....
.....

the bpftrace binary can run normally on the android system，but it can't executed with commands and reports error "unknown target triple", as follow:

$ bpftrace -e 'tracepoint:tcp:tcp_probe { @[comm] = count();}'
error: unknown target triple 'unknown'

How should I solve this problem ?
Thanks.

[1NC4NDESCENCE]

Did you compile it only recently? v0.23.4 bpftools (confirmed with ./bpftrace --version) I compiled last summer works but when I tried to compile again (v0.24.1) yesterday in docker in wsl2, there were many problems, after fixing them all, it is still unusable, likely related to newly added dependency libclang-cpp.so.

OP5D0DL1:/data/local/tmp/bpftools $ ./bpftrace
: CommandLine Error: Option 'disable-bpf-peephole' registered more than once!
LLVM ERROR: inconsistency in registered CommandLine options
Aborted

So I wonder where does the options in your build command come from?
make bpftrace STATIC_LINKING=true LLVM_BPF_ONLY=true NDK_ARCH=arm64 BUILD_TYPE=Release
did something not work?
The build command I tried yesterday was make bpftools THREADS=14

[1NC4NDESCENCE]

I tried compiling bpftrace statically just like you and got exactly the same error

[hunanchenxingyu]

omething not w

Yes，compiled it in docker on the ubuntu last week，the version information of bpftrace is as follows:

./bpftrace --info
System
OS: Linux 5.10.66-02686-g0517003b13e9-dirty #15 SMP PREEMPT Wed Mar 4 15:11:33 CST 2026
Arch: aarch64

Build
version: v0.24.1
LLVM: 18.1.8
bfd: no
libdw (DWARF support): no
libsystemd (systemd notify support): no
blazesym (advanced symbolization): no

libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled?
libbpf: failed to find valid kernel BTF
Kernel helpers
probe_read_user: yes probe_read_user_str: yes
probe_read_kernel: yes probe_read_kernel_str: yes
send_signal: yes get_boot_ns: yes
dpath: no skboutput: no
get_tai_ns: no get_func_ip: no
jiffies64: yes for_each_map_elem: no
get_ns_current_pid_tgid: yes lookup_percpu_elem: no

Kernel features
Instruction limit: 1000000 btf: no
module btf: no map batch: yes

Map types
hash: yes array: yes
percpu array: yes stack_trace: yes
ringbuf: yes

Probe types
kprobe: yes tracepoint: yes
perf_event: yes fentry: no
kprobe_multi: no uprobe_multi: no
kprobe_session: no iter: no

[1NC4NDESCENCE]

omething not w

Yes，compiled it in docker on the ubuntu last week，the version information of bpftrace is as follows:

./bpftrace --info
System
OS: Linux 5.10.66-02686-g0517003b13e9-dirty #15 SMP PREEMPT Wed Mar 4 15:11:33 CST 2026
Arch: aarch64

Build
version: v0.24.1
LLVM: 18.1.8
bfd: no
libdw (DWARF support): no
libsystemd (systemd notify support): no
blazesym (advanced symbolization): no

libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled?
libbpf: failed to find valid kernel BTF
Kernel helpers
probe_read_user: yes probe_read_user_str: yes
probe_read_kernel: yes probe_read_kernel_str: yes
send_signal: yes get_boot_ns: yes
dpath: no skboutput: no
get_tai_ns: no get_func_ip: no
jiffies64: yes for_each_map_elem: no
get_ns_current_pid_tgid: yes lookup_percpu_elem: no

Kernel features
Instruction limit: 1000000 btf: no
module btf: no map batch: yes

Map types
hash: yes array: yes
percpu array: yes stack_trace: yes
ringbuf: yes

Probe types
kprobe: yes tracepoint: yes
perf_event: yes fentry: no
kprobe_multi: no uprobe_multi: no
kprobe_session: no iter: no

So currently both boftrace in bpftools and static bpftrace have problems. I think it might be easier to fix statix bpftrace. I plan on attempting it recently.

[tnovak]

@hunanchenxingyu does removing LLVM_BPF_ONLY=true help?

This flag was added a while ago (when we were still using LLVM 14) in order to reduce the size of the statically linked executable; it doesn't seem to work well with newer LLVM versions. Bpftrace's ClangParser doesn't specify the -target argument explicitly, and (I believe) LLVM now falls back to the host triple which isn't supported when building with LLVM_BPF_ONLY.

[B0tton]

@hunanchenxingyu does removing LLVM_BPF_ONLY=true help?

This flag was added a while ago (when we were still using LLVM 14) in order to reduce the size of the statically linked executable; it doesn't seem to work well with newer LLVM versions. Bpftrace's ClangParser doesn't specify the -target argument explicitly, and (I believe) LLVM now falls back to the host triple which isn't supported when building with LLVM_BPF_ONLY.

Even without enabling LLVM_BPF_ONLY=true, the compiled bpftrace binary still cannot run on Android.

When executing ./bpftrace, it immediately throws an error:

CANNOT LINK EXECUTABLE "bpftrace": library "libclang-cpp.so" not found: needed by main executable

Is there any way to fully remove the dependency on libclang-cpp.so for Android builds?

Thanks!

[tnovak]

Is there any way to fully remove the dependency on libclang-cpp.so for Android builds?

@B0tton the easiest way is to build with STATIC_LINKING=true. Alternatively, you can push libclang-cpp.so and other shared libraries from out/android to the device.

Something like this should work (adjust NDK_PATH as needed):

$ make NDK_ARCH=arm64 BUILD_TYPE=Release STATIC_LINKING=true NDK_PATH=$HOME/android-ndk-r29 bpftools-min
$ adb push build/android/arm64/bpftrace/src/bpftrace /data/local/tmp/

[B0tton]

Is there any way to fully remove the dependency on libclang-cpp.so for Android builds?

@B0tton the easiest way is to build with STATIC_LINKING=true. Alternatively, you can push libclang-cpp.so and other shared libraries from out/android to the device.

Something like this should work (adjust NDK_PATH as needed):

$ make NDK_ARCH=arm64 BUILD_TYPE=Release STATIC_LINKING=true NDK_PATH=$HOME/android-ndk-r29 bpftools-min
$ adb push build/android/arm64/bpftrace/src/bpftrace /data/local/tmp/

Thanks a lot for your help and explanation, it was really useful!I’ve managed to compile bpftrace successfully and it now works properly on my Android device.
The command I ended up using is make bpftools STATIC_LINKING=true LLVM=1 LD=ld.lld -j4
Really appreciate your support!