1- Kprobe-based Event Tracer
2- =========================
1+ Kprobe-based Event Tracing
2+ = =========================
33
44 Documentation is written by Masami Hiramatsu
55
66
77Overview
88--------
9- This tracer is similar to the events tracer which is based on Tracepoint
10- infrastructure. Instead of Tracepoint, this tracer is based on kprobes(kprobe
11- and kretprobe). It probes anywhere where kprobes can probe(this means, all
12- functions body except for __kprobes functions).
9+ These events are similar to tracepoint based events. Instead of Tracepoint,
10+ this is based on kprobes (kprobe and kretprobe). So it can probe wherever
11+ kprobes can probe (this means, all functions body except for __kprobes
12+ functions). Unlike the Tracepoint based event, this can be added and removed
13+ dynamically, on the fly.
1314
14- Unlike the function tracer, this tracer can probe instructions inside of
15- kernel functions. It allows you to check which instruction has been executed.
15+ To enable this feature, build your kernel with CONFIG_KPROBE_TRACING=y.
1616
17- Unlike the Tracepoint based events tracer, this tracer can add and remove
18- probe points on the fly.
19-
20- Similar to the events tracer, this tracer doesn't need to be activated via
21- current_tracer, instead of that, just set probe points via
22- /sys/kernel/debug/tracing/kprobe_events. And you can set filters on each
23- probe events via /sys/kernel/debug/tracing/events/kprobes/<EVENT>/filter.
17+ Similar to the events tracer, this doesn't need to be activated via
18+ current_tracer. Instead of that, add probe points via
19+ /sys/kernel/debug/tracing/kprobe_events, and enable it via
20+ /sys/kernel/debug/tracing/events/kprobes/<EVENT>/enabled.
2421
2522
2623Synopsis of kprobe_events
@@ -55,9 +52,9 @@ Per-Probe Event Filtering
5552-------------------------
5653 Per-probe event filtering feature allows you to set different filter on each
5754probe and gives you what arguments will be shown in trace buffer. If an event
58- name is specified right after 'p:' or 'r:' in kprobe_events, the tracer adds
59- an event under tracing/events/kprobes/<EVENT>, at the directory you can see
60- 'id', ' enabled', 'format' and 'filter'.
55+ name is specified right after 'p:' or 'r:' in kprobe_events, it adds an event
56+ under tracing/events/kprobes/<EVENT>, at the directory you can see 'id',
57+ 'enabled', 'format' and 'filter'.
6158
6259enabled:
6360 You can enable/disable the probe by writing 1 or 0 on it.
@@ -71,6 +68,7 @@ filter:
7168id:
7269 This shows the id of this probe event.
7370
71+
7472Event Profiling
7573---------------
7674 You can check the total number of probe hits and probe miss-hits via
0 commit comments