[lttng-docs.git] / contents / getting-started / tracing-the-linux-kernel.md

---
id: tracing-the-linux-kernel
---

Make sure LTTng-tools and LTTng-modules packages
[are installed](#doc-installing-lttng).

Since you're about to trace the Linux kernel itself, let's look at the
available kernel events using the `lttng` tool, which has a
Git-like command line structure:

<pre class="term">
lttng list --kernel
</pre>

Before tracing, you need to create a session:

<pre class="term">
sudo lttng create
</pre>

<div class="tip">
<p>
    <span class="t">Tip:</span>You can avoid using <code>sudo</code> in
    the previous and following commands if your user is a member of the
    <a href="#doc-lttng-sessiond" class="int"><code>tracing</code>
    group</a>.
</p>
</div>

Let's now enable some events for this session:

<pre class="term">
sudo lttng enable-event --kernel sched_switch,sched_process_fork
</pre>

Or you might want to simply enable all available kernel events (beware
that trace files grow rapidly when doing this):

<pre class="term">
sudo lttng enable-event --kernel --all
</pre>

Start tracing:

<pre class="term">
sudo lttng start
</pre>

By default, traces are saved in
<code>~/lttng-traces/<em>name</em>-<em>date</em>-<em>time</em></code>,
where <code><em>name</em></code> is the session name.

When you're done tracing:

<pre class="term">
sudo lttng stop
sudo lttng destroy
</pre>

Although `destroy` looks scary here, it doesn't actually destroy the
written trace files: it only destroys the tracing session.

What's next? Have a look at
[Viewing and analyzing your traces](#doc-viewing-and-analyzing-your-traces)
to view and analyze the trace you just recorded.
Commit	Line	Data
	1	---
	2	id: tracing-the-linux-kernel
	3	---
	4
	5	Make sure LTTng-tools and LTTng-modules packages
	6	[are installed](#doc-installing-lttng).
	7
	8	Since you're about to trace the Linux kernel itself, let's look at the
	9	available kernel events using the `lttng` tool, which has a
	10	Git-like command line structure:
	11
	12	<pre class="term">
	13	lttng list --kernel
	14	</pre>
	15
	16	Before tracing, you need to create a session:
	17
	18	<pre class="term">
	19	sudo lttng create
	20	</pre>
	21
	22	<div class="tip">
	23	<p>
	24	<span class="t">Tip:</span>You can avoid using <code>sudo</code> in
	25	the previous and following commands if your user is a member of the
	26	<a href="#doc-lttng-sessiond" class="int"><code>tracing</code>
	27	group</a>.
	28	</p>
	29	</div>
	30
	31	Let's now enable some events for this session:
	32
	33	<pre class="term">
	34	sudo lttng enable-event --kernel sched_switch,sched_process_fork
	35	</pre>
	36
	37	Or you might want to simply enable all available kernel events (beware
	38	that trace files grow rapidly when doing this):
	39
	40	<pre class="term">
	41	sudo lttng enable-event --kernel --all
	42	</pre>
	43
	44	Start tracing:
	45
	46	<pre class="term">
	47	sudo lttng start
	48	</pre>
	49
	50	By default, traces are saved in
	51	<code>~/lttng-traces/<em>name</em>-<em>date</em>-<em>time</em></code>,
	52	where <code><em>name</em></code> is the session name.
	53
	54	When you're done tracing:
	55
	56	<pre class="term">
	57	sudo lttng stop
	58	sudo lttng destroy
	59	</pre>
	60
	61	Although `destroy` looks scary here, it doesn't actually destroy the
	62	written trace files: it only destroys the tracing session.
	63
	64	What's next? Have a look at
	65	[Viewing and analyzing your traces](#doc-viewing-and-analyzing-your-traces)
	66	to view and analyze the trace you just recorded.