lttng(1) (v2.7)

Add context to event(s) and/or channel(s).

A context is basically extra information appended to a channel. For instance, you could ask the tracer to add the PID information for all events in a channel. You can also add performance monitoring unit counters (perf PMU) using the perf kernel API.

For example, this command will add the context information 'prio' and two per-CPU perf counters (hardware branch misses and cache misses), to all events in the trace data output:

# lttng add-context -k -t prio -t perf:cpu:branch-misses \
		-t perf:cpu:cache-misses

Please take a look at the help (-h/--help) for a detailed list of available contexts.

Perf counters are available as per-CPU ("perf:cpu:...") and per-thread ("perf:thread:...") counters. Currently, per-CPU counters can only be used with the kernel tracing domain, and per-thread counters can only be used with the UST tracing domain.

If no channel is given (-c), the context is added to all channels that were already enabled. If the session has no channel, a default channel is created. Otherwise the context will be added only to the given channel (-c).

If -s, --session is omitted, the session name is taken from the .lttngrc file.

OPTIONS:

-h, --help

Show summary of possible options and commands.

-s, --session NAME

Apply on session name.

-c, --channel NAME

Apply on channel name.

-k, --kernel

Apply for the kernel tracer

-u, --userspace

Apply for the user-space tracer

-t, --type TYPE

Context type. You can repeat this option on the command line. Please use "lttng add-context -h" to list all available types.

Quantify LTTng overhead

The LTTng calibrate command can be used to find out the combined average overhead of the LTTng tracer and the instrumentation mechanisms used. This overhead can be calibrated in terms of time or using any of the PMU performance counter available on the system.

For now, the only calibration implemented is that of the kernel function instrumentation (kretprobes).

* Calibrate kernel function instrumentation

Let's use an example to show this calibration. We use an i7 processor with 4 general-purpose PMU registers. This information is available by issuing dmesg, looking for "generic registers".

This sequence of commands will gather a trace executing a kretprobe hooked on an empty function, gathering PMU counters LLC (Last Level Cache) misses information (see lttng add-context --help to see the list of available PMU counters).

# lttng create calibrate-function
# lttng enable-event calibrate --kernel \
	--function lttng_calibrate_kretprobe
# lttng add-context --kernel -t perf:cpu:LLC-load-misses \
	-t perf:cpu:LLC-store-misses \
	-t perf:cpu:LLC-prefetch-misses
# lttng start
# for a in $(seq 1 10); do \
        lttng calibrate --kernel --function;
  done
# lttng destroy
# babeltrace $(ls -1drt ~/lttng-traces/calibrate-function-* \
	| tail -n 1)

The output from babeltrace can be saved to a text file and opened in a spreadsheet (e.g. oocalc) to focus on the per-PMU counter delta between consecutive "calibrate_entry" and "calibrate_return" events. Note that these counters are per-CPU, so scheduling events would need to be present to account for migration between CPU. Therefore, for calibration purposes, only events staying on the same CPU must be considered.

The average result, for the i7, on 10 samples:

                          Average     Std.Dev.
perf_LLC_load_misses:       5.0       0.577
perf_LLC_store_misses:      1.6       0.516
perf_LLC_prefetch_misses:   9.0      14.742

As we can notice, the load and store misses are relatively stable across runs (their standard deviation is relatively low) compared to the prefetch misses. We can conclude from this information that LLC load and store misses can be accounted for quite precisely, but prefetches within a function seems to behave too erratically (not much causality link between the code executed and the CPU prefetch activity) to be accounted for.

OPTIONS:

-h, --help

Show summary of possible options and commands.

-k, --kernel

Apply for the kernel tracer

-u, --userspace

Apply for the user-space tracer

--function

Dynamic function entry/return probe (default)

Create tracing session.

A tracing session contains channel(s) which contains event(s). It is domain agnostic, meaning that channels and events can be enabled for the user-space tracer and/or the kernel tracer. It acts like a container aggregating multiple tracing sources.

On creation, a .lttngrc file is created in your $HOME directory containing the current session name. If NAME is omitted, a session name is automatically created having this form: 'auto-yyyymmdd-hhmmss'.

If no -o, --output is specified, the traces will be written in $HOME/lttng-traces.

The $HOME environment variable can be overridden by defining the environment variable LTTNG_HOME. This is useful when the user running the commands has a non-writeable home directory.

The session name MUST NOT contain the character '/'.

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

-o, --output PATH

Specify output path for traces

--no-output

Traces will not be output

--snapshot

Set the session in snapshot mode. Created in no-output mode and uses the URL, if one is specified, as the default snapshot output. Every channel will be set in overwrite mode and with mmap output (splice not supported).

--live [USEC]

Set the session exclusively in live mode. The parameter is the delay in micro seconds before the data is flushed and streamed. The live mode allows you to stream the trace and view it while it's being recorded by any tracer. For that, you need a lttng-relayd and this session requires a network URL (-U or -C/-D). If no USEC nor URL is provided, the default is to use a timer value set to 1000000 and the network URL set to net://127.0.0.1.

To read a live session, you can use babeltrace(1) or the live streaming protocol in doc/live-reading-protocol.txt. Here is an example:

$ lttng-relayd -o /tmp/lttng
$ lttng create --live 200000 -U net://localhost
$ lttng enable-event -a --userspace
$ lttng start

After the start, you'll be able to read the events while they are being recorded in /tmp/lttng.

--shm-path PATH

Path where shared memory holding buffers should be created. Useful when used with PRAMFS or other persistent memory filesystems to extract trace data in the event of a crash requiring a reboot.

See the lttng-crash(1) utility for more information on crash recovery.

-U, --set-url=URL

Set URL for the consumer output destination. It is persistent for the session lifetime. Redo the command to change it. This will set both data and control URL for network.

-C, --ctrl-url=URL

Set control path URL. (Must use -D also)

-D, --data-url=URL

Set data path URL. (Must use -C also)

Teardown tracing session

Free memory on the session daemon and tracer side. It's gone!

If NAME is omitted, the session name is taken from the .lttngrc file.

OPTIONS:

-h, --help

Show summary of possible options and commands.

-a, --all

Destroy all sessions

--list-options

Simple listing of options

Enable tracing channel

To enable an event, you must enable both the event and the channel that contains it.

If -s, --session is omitted, the session name is taken from the .lttngrc file.

Exactly one of -k or -u must be specified.

It is important to note that if a certain type of buffers is used, the session will be set with that type and all other subsequent channel needs to have the same type.

Note that once the session has been started and enabled on the tracer side, it's not possible anymore to enable a new channel for that session.

OPTIONS:

-h, --help

Show this help

--list-options

Simple listing of options

-s, --session NAME

Apply on session name

-k, --kernel

Apply to the kernel tracer

-u, --userspace

Apply to the user-space tracer

--discard

Discard event when subbuffers are full (default)

--overwrite

Flight recorder mode: overwrites events when subbuffers are full. The number of subbuffer must be 2 or more.

--subbuf-size SIZE

Subbuffer size in bytes {+k,+M,+G}. (default UST uid: 131072, UST pid: 4096, kernel: 262144, metadata: 4096) Rounded up to the next power of 2.

The minimum subbuffer size, for each tracer, is the max value between the default above and the system page size. You can issue this command to get the current page size on your system: $ getconf PAGE_SIZE

--num-subbuf NUM

Number of subbuffers. (default UST uid: 4, UST pid: 4, kernel: 4, metadata: 2) Rounded up to the next power of 2.

--switch-timer USEC

Switch subbuffer timer interval in µsec. (default UST uid: 0, UST pid: 0, kernel: 0, metadata: 0)

--read-timer USEC

Read timer interval in µsec. (default UST uid: 0, UST pid: 0, kernel: 200000, metadata: 0)

--output TYPE

Channel output type. Possible values: mmap, splice (default UST uid: mmap, UST pid: mmap, kernel: splice, metadata: mmap)

--buffers-uid

Use per UID buffer (-u only). Buffers are shared between applications that have the same UID.

--buffers-pid

Use per PID buffer (-u only). Each application has its own buffers.

--buffers-global

Use shared buffer for the whole system (-k only)

-C, --tracefile-size SIZE

Maximum size of each tracefile within a stream (in bytes). 0 means unlimited. (default: 0) Note: traces generated with this option may inaccurately report discarded events as of CTF 1.8.

-W, --tracefile-count COUNT

Used in conjunction with -C option, this will limit the number of files created to the specified count. 0 means unlimited. (default: 0)

EXAMPLES:

$ lttng enable-channel -k -C 4096 -W 32 chan1

For each stream, the maximum size of each trace file will be 4096 bytes and there will be a maximum of 32 different files. The file count is appended after the stream number as seen in the following example. The last trace file is smaller than 4096 since it was not completely filled.

        ~/lttng-traces/[...]/chan1_0_0 (4096)
        ~/lttng-traces/[...]/chan1_0_1 (4096)
        ~/lttng-traces/[...]/chan1_0_2 (3245)
        ~/lttng-traces/[...]/chan1_1_0 (4096)
        ...

$ lttng enable-channel -k -C 4096

This will create trace files of 4096 bytes and will create new ones as long as there is data available.

Enable tracing event

A tracing event is always assigned to a channel. If -c, --channel is omitted, a default channel named 'channel0' is created and the event is added to it. If -c, --channel is omitted, but a non-default channel already exists within the session, an error is returned. For the user-space tracer, using -a, --all is the same as using the wildcard "*".

If -s, --session is omitted, the session name is taken from the .lttngrc file.

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

-s, --session NAME

Apply on session name

-c, --channel NAME

Apply on channel name

-a, --all

Enable all tracepoints and syscalls. This actually enables a single wildcard event "*".

-k, --kernel

Apply for the kernel tracer

-u, --userspace

Apply for the user-space tracer

-j, --jul

Apply for Java application using Java Util Logging interface (JUL)

-l, --log4j

Apply for Java application using LOG4J

-p, --python

Apply for Python application using the logging module.

--tracepoint

Tracepoint event (default). Userspace tracer supports wildcards at the end of string. Don't forget to quote to deal with bash expansion. e.g.:

        "*"
        "app_component:na*"

--loglevel NAME

Tracepoint loglevel range from 0 to loglevel. Listed in the help (-h). For the JUL domain, the loglevel ranges are detailed with the --help option thus starting from SEVERE to FINEST. For the LOG4J domain, loglevels range from FATAL to TRACE which are also detailed in the help. For the Python domain, loglevels range from CRITICAL to DEBUG which are detailed in the help as well.

--loglevel-only NAME

Tracepoint loglevel (only this loglevel). The loglevel or loglevel-only options should be combined with a tracepoint name or tracepoint wildcard.

--probe (addr | symbol | symbol+offset)

Dynamic probe. Addr and offset can be octal (0NNN...), decimal (NNN...) or hexadecimal (0xNNN...)

--function (addr | symbol | symbol+offset)

Dynamic function entry/return probe. Addr and offset can be octal (0NNN...), decimal (NNN...) or hexadecimal (0xNNN...)

--syscall

System call event.

--filter 'expression'

Set a filter on a newly enabled event. Filter expression on event fields and context. The event will be recorded if the filter's expression evaluates to TRUE. Only specify on first activation of a given event within a session. Specifying a filter is only allowed when enabling events within a session before tracing is started. If the filter fails to link with the event within the traced domain, the event will be discarded.

Expression examples:

  'intfield > 500 && intfield < 503'
  '(strfield == "test" || intfield != 10) && intfield > 33'
  'doublefield > 1.1 && intfield < 5.3'

Wildcards are allowed at the end of strings: 'seqfield1 == "te*"' In string literals, the escape character is a '\'. Use '\*' for the '*' character, and '\\' for the '\' character sequence. Wildcard matches any sequence of characters, including an empty sub-string (matches 0 or more characters).

Context information can be used for filtering. The examples below shows usage of context filtering on the process name (using a wildcard), process ID range, and unique thread ID. The process and thread IDs of running applications can be found under columns "PID" and "LWP" of the "ps -eLf" command.

  '$ctx.procname == "demo*"'
  '$ctx.vpid >= 4433 && $ctx.vpid < 4455'
  '$ctx.vtid == 1234'

Context information is available to all filters whether or not the add-context command has been used to add it to the event's channel, as long as the context field exists for that domain. For example, the filter examples given above will never fail to link: no add-context is required for the event's channel.

-x, --exclude LIST

Add exclusions to UST tracepoints: Events that match any of the items in the comma-separated LIST are not enabled, even if they match a wildcard definition of the event.

This option is also applicable with the -a, --all option, in which case all UST tracepoints are enabled except the ones whose names match any of the items in LIST.

Disable tracing channel

Disabling a channel disables the tracing of all of the channel's events. A channel can be re-enabled by calling lttng enable-channel NAME again.

If -s, --session is omitted, the session name is taken from the .lttngrc file.

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

-s, --session NAME

Apply on session name

-k, --kernel

Apply for the kernel tracer

-u, --userspace

Apply for the user-space tracer

Disable tracing event

The event, once disabled, can be re-enabled by calling lttng enable-event NAME again.

If -s, --session is omitted, the session name is taken from the .lttngrc file.

If -c, --channel is omitted, the default channel name is used. If -c, --channel is omitted, but a non-default channel already exists within the session, an error is returned.

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

-s, --session NAME

Apply on session name

-c, --channel NAME

Apply on channel name

-a, --all-events

Disable all events. This does NOT ONLY disable "*" but rather every known events of the session

-k, --kernel

Apply for the kernel tracer

-u, --userspace

Apply for the user-space tracer

-j, --jul

Apply for Java application using Java Util Logging interface (JUL)

-l, --log4j

Apply for Java application using LOG4J

-p, --python

Apply for Python application using the logging module

TYPE (kernel domain only):--all

Disable event of all type

--tracepoint

Disable event of type tracepoint

--syscall

Disable event of type syscall

--probe

Disable event of type probe

--function

Disable event of type function

List tracing session information.

With no arguments, it will list available tracing session(s).

With the session name, it will display the details of the session including the trace file path, the associated channels and their state (activated and deactivated), the activated events and more.

With -k alone, it will list all available kernel events (except the system calls events). With -j alone, the available JUL event from registered application will be list. The event corresponds to the Logger name in the Java JUL application. With -l alone, the available LOG4J event from registered application will be list. The event corresponds to the Logger name in the Java LOG4J application. With -p alone, the available Python event from registered application will be list. The event corresponds to the Logger name in the Python application. With -u alone, it will list all available user-space events from registered applications. Here is an example of 'lttng list -u':

PID: 7448 - Name: /tmp/lttng-ust/tests/hello/.libs/lt-hello
      ust_tests_hello:tptest_sighandler (type: tracepoint)
      ust_tests_hello:tptest (type: tracepoint)

You can now enable any event listed by using the name : ust_tests_hello:tptest.

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

-k, --kernel

Select kernel domain

-u, --userspace

Select user-space domain.

-j, --jul

Apply for Java application using JUL

-l, --log4j

Apply for Java application using LOG4J

-p, --python

Apply for Python application using the logging module.

-f, --fields

List event fields

Load tracing session configuration

If NAME is omitted, all session configurations found in both the user's session configuration directory (default: ~/.lttng/sessions/) and the system session configuration directory (default: /etc/lttng/sessions/) will be loaded. Note that the sessions in the user directory are loaded first and then the system wide directory are loaded.

OPTIONS:

-h, --help

Show summary of possible options and commands.

-a, --all

Load all session configurations (default).

-i, --input-path PATH

Specify the input path for session configurations. This overrides the default session configuration directory.

-f, --force

Overwrite current session configuration(s) if a session of the same name already exists.

Save tracing session configuration

If SESSION is omitted, all session configurations will be saved to individual .lttng files under the user's session configuration directory (default: ~/.lttng/sessions/). The default session configuration file naming scheme is SESSION.lttng.

For instance, a user in the tracing group saving a session from a root session daemon will save it in her/his user directory.

OPTIONS:

-h, --help

Show summary of possible options and commands.

-a, --all

Save all session configurations (default).

-o, --output-path PATH

Specify the output path for saved sessions. This overrides the default session configuration directory.

-f, --force

Overwrite session configuration file if session name clashes.

Set current session name

Will change the session name in the .lttngrc file.

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

Snapshot command for LTTng session.

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

Start tracing

It will start tracing for all tracers for a specific tracing session. If NAME is omitted, the session name is taken from the .lttngrc file.

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

Stop tracing

It will stop tracing for all tracers for a specific tracing session. Before returning, the command checks for data availability meaning that it will wait until the trace is readable for the session. Use --no-wait to avoid this behavior.

If NAME is omitted, the session name is taken from the .lttngrc file.

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

--no-wait

Don't wait for data availability.

Adds one or more entries to a tracker

The track command adds one or more entries to a tracker. A tracker is a whitelist of resources. Tracked resources are allowed to emit events, provided those events are enabled (see the enable-event command).

Tracker entries can be removed from the whitelist with the untrack command.

As of this version, the only available tracker is the PID tracker. The process ID (PID) tracker follows one or more process IDs; only the processes with a tracked PID are allowed to emit events. By default, all possible PIDs on the system are tracked: any process may emit enabled events (equivalent of lttng track --pid --all for all domains).

With the PID tracker, it is possible, for example, to record all system calls called by a given process:

    $ lttng enable-event --kernel --all --syscall
    $ lttng track --kernel --pid 2345
    $ lttng start

If all the PIDs are tracked (i.e. lttng track --pid --all, which is the default state of all domains when creating a tracing session), then using the track command with one or more specific PIDs has the effect of first removing all the PIDs from the whitelist, then adding the specified PIDs.

Assume the maximum PID is 7 for the following examples:

    Initial whitelist: [0] [1] [2] [3] [4] [5] [6] [7]

    $ lttng track --userspace --pid 3,6,7

            Whitelist: [ ] [ ] [ ] [3] [ ] [ ] [6] [7]

    $ lttng untrack --userspace --pid 7

            Whitelist: [ ] [ ] [ ] [3] [ ] [ ] [6] [ ]

    $ lttng track --userspace --pid 1,5

            Whitelist: [ ] [1] [ ] [3] [ ] [5] [6] [ ]

It should be noted that the PID tracker tracks the numeric process IDs. Should a process with a given ID exit and another process be given this ID, then the latter would also be allowed to emit events.

See the untrack command's documentation for more details about removing entries.

OPTIONS:

-s, --session NAME

Apply to session name.

-k, --kernel

Apply to the kernel tracer.

-u, --userspace

Apply to the user space tracer.

-p, --pid [PIDS]

Track process IDs PIDS (add to whitelist).

PIDS is a comma-separated list of PIDs to add to the PID tracker.

The PIDS argument must be omitted when also using the --all option.

-a, --all

Used in conjunction with an empty --pid option: track all process IDs (add all entries to whitelist).

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

Removes one or more entries from a tracker

See the track command's documentation to learn more about LTTng trackers.

The untrack command removes specific resources from a tracker. The resources to remove must have been precedently added by the track command. It is also possible to remove all the resources from the whitelist using the --all option.

As of this version, the only available tracker is the PID tracker.

One common operation is to create a tracing session, remove all the entries from the PID tracker whitelist, start tracing, and then manually track PIDs while tracing is active.

Assume the maximum PID is 7 for the following examples:

    $ lttng create

    Initial whitelist: [0] [1] [2] [3] [4] [5] [6] [7]

    $ lttng untrack --userspace --pid --all

            Whitelist: [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ]

    $ lttng enable-event --userspace ...
    $ lttng start
    ...
    $ lttng track --userspace --pid 3,5

            Whitelist: [ ] [ ] [ ] [3] [ ] [5] [ ] [ ]

    $ lttng track --userspace --pid 2

            Whitelist: [ ] [ ] [2] [3] [ ] [5] [ ] [ ]

See the track command's documentation for more details about adding entries.

OPTIONS:

-s, --session NAME

Apply to session name.

-k, --kernel

Apply to the kernel tracer.

-u, --userspace

Apply to the user space tracer.

-p, --pid [PIDS]

Stop tracking process IDs PIDS (remove from whitelist).

PIDS is a comma-separated list of PIDs to remove from the PID tracker.

The PIDS argument must be omitted when also using the --all option.

-a, --all

Used in conjunction with an empty --pid option: stop tracking all process IDs (remove all entries from whitelist).

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

Show version information

OPTIONS:

-h, --help

Show summary of possible options and commands.

--list-options

Simple listing of options

View traces of a tracing session. By default, the babeltrace viewer will be used for text viewing. If SESSION_NAME is omitted, the session name is taken from the .lttngrc file.

OPTIONS:

-h, --help

Show this help

--list-options

Simple listing of options

-t, --trace-path PATH

Trace directory path for the viewer

-e, --viewer CMD

Specify viewer and/or options to use This will completely override the default viewers so please make sure to specify the full command. The trace directory path of the session will be appended at the end to the arguments