| 1 | --- |
| 2 | id: tracing-the-linux-kernel |
| 3 | --- |
| 4 | |
| 5 | Make sure LTTng-tools and LTTng-modules packages |
| 6 | [are installed](#doc-installing-lttng). |
| 7 | |
| 8 | Since you're about to trace the Linux kernel itself, let's look at the |
| 9 | available kernel events using the `lttng` tool, which has a |
| 10 | Git like command line structure: |
| 11 | |
| 12 | <pre class="term"> |
| 13 | lttng list --kernel |
| 14 | </pre> |
| 15 | |
| 16 | <div class="tip"> |
| 17 | <p> |
| 18 | <span class="t">Tip:</span>You can avoid using <code>sudo</code> in |
| 19 | the previous and following commands if your user is part of the |
| 20 | <a href="/docs/#doc-lttng-sessiond"><code>tracing</code> group</a>. |
| 21 | </p> |
| 22 | </div> |
| 23 | |
| 24 | Before tracing, you need to create a session: |
| 25 | |
| 26 | <pre class="term"> |
| 27 | sudo lttng create my-session |
| 28 | </pre> |
| 29 | |
| 30 | `my-session` is the tracing session name and could be anything you |
| 31 | like. `auto` will be used if omitted. |
| 32 | |
| 33 | Let's now enable some events for this session: |
| 34 | |
| 35 | <pre class="term"> |
| 36 | sudo lttng enable-event --kernel sched_switch,sched_process_fork |
| 37 | </pre> |
| 38 | |
| 39 | or you might want to simply enable all available kernel events (beware |
| 40 | that trace files will grow rapidly when doing this): |
| 41 | |
| 42 | <pre class="term"> |
| 43 | sudo lttng enable-event --kernel --all |
| 44 | </pre> |
| 45 | |
| 46 | Start tracing: |
| 47 | |
| 48 | <pre class="term"> |
| 49 | sudo lttng start |
| 50 | </pre> |
| 51 | |
| 52 | By default, traces are saved in |
| 53 | <code>~/lttng-traces/<em>name</em>-<em>date</em>-<em>time</em></code>, |
| 54 | where <code><em>name</em></code> is the session name. |
| 55 | |
| 56 | When you're done tracing: |
| 57 | |
| 58 | <pre class="term"> |
| 59 | sudo lttng stop |
| 60 | sudo lttng destroy |
| 61 | </pre> |
| 62 | |
| 63 | Although `destroy` looks scary here, it doesn't actually destroy the |
| 64 | outputted traces: it only destroys the tracing session. |
| 65 | |
| 66 | What's next? Have a look at |
| 67 | [Viewing and analyzing your traces](#doc-viewing-and-analyzing-your-traces) |
| 68 | to view and analyze the trace you just recorded. |