Features — LTTng

LTTng is an open source tracing framework for Linux.

System-wide insight

LTTng allows to understand the interactions between multiple components of a given system, i.e.:

The Linux kernel, using either already available or user-defined instrumentation points
C/C++ applications
Java applications
Python applications
Any other user space application using the LTTng logger

Tracing all those components with LTTng produces a unified log of events, providing great insight into the system's behavior. Here's a simplified example of a system trace:

Time	App.	Event	Payload
17:23:05.035454	my-app	startup
17:23:05.043948	my-app	readConfigBegin	path=`/home/mole/.my-app/config`
17:23:05.044120	linux	sys_open	pathname=`/home/mole/.my-app/config` flags=`O_RDONLY` ret=`5`
17:23:05.044120	linux	sys_fstat	fd=`5` ret={st_uid=`1002`, st_size=`4608`, ...}
17:23:05.044498	linux	sys_read	fd=`5` buf=`0x7fcd0128` count=`4608` ret=`4608`
17:23:05.046005	linux	sys_close	fd=`5` ret=`0`
17:23:05.047948	my-app	readConfigEnd
17:23:06.164870	my-app	getUser	username=`joe`
17:23:06.251164	java-db	doQuery	handle=`23` query=`SELECT * FROM users WHERE`... success=`true`
...	...	...	...

High performance

LTTng is designed from the ground up to provide low overhead tracing on production systems. The tracers achieve this great performance through a combination of essential techniques such as per-CPU buffering, RCU data structures, a compact and efficient binary trace format, and more.

LTTng disturbs the traced system as little as possible in order to make tracing of subtle race conditions and rare interrupt cascades possible.

On platforms where resources are limited, such as some Linux embedded systems, you can use LTTng out of the box to help developers pinpoint the sources of hard-to-debug issues.

Flexible

Whether your target is a small embedded system or a large cloud, LTTng provides flexible configuration options that can accommodate the system's workload. LTTng supports architectures such as IA-32 (x86), x86-64, PowerPC, ARM, and MIPS, amongst others.

LTTng's tracing session mechanism makes it possible to record multiple traces concurrently with different configuration options. Each Unix user may create and configure as many tracing sessions as needed.

Depending on your specific scenario, you may wish, for example, to:

Trace locally: Record a trace to the target's local filesystem, then use one of the many compatible viewers to investigate what happened.
Trace remotely: Send trace data over the network.
View a live stream: Monitor events as they occur, in real-time.
Take a snapshot: When desired, keep only a fixed-sized log of the latest events.
Keep ring buffers' shared memory on a persistent memory file system.

Easy

As LTTng is packaged for many major Linux distributions, you can often use your package manager to install it.

As a user, you control the tracers with a single tool, the lttng command-line interface.

Multiple tools are available to view and analyze the traces that LTTng produces: GUI, CLI tools, and custom scripts.