| 1 | lttng-enable-event(1) |
| 2 | ===================== |
| 3 | |
| 4 | |
| 5 | NAME |
| 6 | ---- |
| 7 | lttng-enable-event - Create or enable LTTng event rules |
| 8 | |
| 9 | |
| 10 | SYNOPSIS |
| 11 | -------- |
| 12 | Create or enable Linux kernel event rules: |
| 13 | |
| 14 | [verse] |
| 15 | *lttng* ['linkgenoptions:(GENERAL OPTIONS)'] *enable-event* option:--kernel |
| 16 | [option:--probe='SOURCE' | option:--function='SOURCE' | option:--syscall] |
| 17 | [option:--filter='EXPR'] [option:--session='SESSION'] |
| 18 | [option:--channel='CHANNEL'] 'EVENT'[,'EVENT']... |
| 19 | |
| 20 | Create or enable an "all" Linux kernel event rule: |
| 21 | |
| 22 | [verse] |
| 23 | *lttng* ['linkgenoptions:(GENERAL OPTIONS)'] *enable-event* option:--kernel option:--all [option:--syscall] |
| 24 | [option:--filter='EXPR'] [option:--session='SESSION'] [option:--channel='CHANNEL'] |
| 25 | |
| 26 | Create or enable application event rules: |
| 27 | |
| 28 | [verse] |
| 29 | *lttng* ['linkgenoptions:(GENERAL OPTIONS)'] *enable-event* |
| 30 | (option:--userspace | option:--jul | option:--log4j | option:--python) |
| 31 | [option:--filter='EXPR'] [option:--exclude='EVENT'[,'EVENT']...] |
| 32 | [option:--loglevel='LOGLEVEL' | option:--loglevel-only='LOGLEVEL'] |
| 33 | [option:--session='SESSION'] [option:--channel='CHANNEL'] (option:--all | 'EVENT'[,'EVENT']...) |
| 34 | |
| 35 | |
| 36 | DESCRIPTION |
| 37 | ----------- |
| 38 | The `lttng enable-event` command can create a new event rule, or enable |
| 39 | one or more existing and disabled ones. |
| 40 | |
| 41 | An event rule created by `lttng enable-event` is a set of conditions |
| 42 | that must be satisfied in order for an actual event to be emitted by |
| 43 | an LTTng tracer when the execution of an application or the Linux kernel |
| 44 | reaches an event source (tracepoint, system call, dynamic probe). |
| 45 | Event sources can be listed with the linklttng:lttng-list(1) command. |
| 46 | |
| 47 | The linklttng:lttng-disable-event(1) command can be used to disable |
| 48 | existing event rules. |
| 49 | |
| 50 | Event rules are always assigned to a channel when they are created. If |
| 51 | the option:--channel option is omitted, a default channel named |
| 52 | `channel0` is used (and created automatically if it does not exist for |
| 53 | the specified domain in the selected tracing session). |
| 54 | |
| 55 | If the option:--session option is omitted, the chosen channel is picked |
| 56 | from the current tracing session. |
| 57 | |
| 58 | Events can be enabled while tracing is active |
| 59 | (use linklttng:lttng-start(1) to make a tracing session active). |
| 60 | |
| 61 | |
| 62 | Event source types |
| 63 | ~~~~~~~~~~~~~~~~~~ |
| 64 | Four types of event sources are available in the Linux kernel tracing |
| 65 | domain (option:--kernel option): |
| 66 | |
| 67 | Tracepoint (option:--tracepoint option; default):: |
| 68 | A Linux kernel tracepoint, that is, a static instrumentation point |
| 69 | placed in the kernel source code. Standard tracepoints are designed |
| 70 | and placed in the source code by developers and record useful |
| 71 | payload fields. |
| 72 | |
| 73 | Dynamic probe (option:--probe option):: |
| 74 | A Linux kernel kprobe, that is, an instrumentation point placed |
| 75 | dynamically in the compiled kernel code. Dynamic probe events do not |
| 76 | record any payload field. |
| 77 | |
| 78 | Function probe (option:--function option):: |
| 79 | A Linux kernel kretprobe, that is, two instrumentation points placed |
| 80 | dynamically where a function is entered and where it returns in the |
| 81 | compiled kernel code. Function probe events do not record any |
| 82 | payload field. |
| 83 | |
| 84 | System call (option:--syscall option):: |
| 85 | A Linux kernel system call. Two instrumentation points are |
| 86 | statically placed where a system call function is entered and where |
| 87 | it returns in the compiled kernel code. System call event sources |
| 88 | record useful payload fields. |
| 89 | |
| 90 | The application tracing domains (option:--userspace, option:--jul, |
| 91 | option:--log4j, or option:--python options) only support tracepoints. |
| 92 | In the cases of the JUL, Apache log4j, and Python domains, the event |
| 93 | names correspond to _logger_ names. |
| 94 | |
| 95 | |
| 96 | Understanding event rule conditions |
| 97 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 98 | When creating an event rule with `lttng enable-event`, conditions are |
| 99 | specified using options. The logical conjunction (logical AND) of all |
| 100 | those conditions must be true when an event source is reached by an |
| 101 | application or by the Linux kernel in order for an actual event |
| 102 | to be emitted by an LTTng tracer. |
| 103 | |
| 104 | Any condition that is not explicitly specified on creation is considered |
| 105 | a _don't care_. |
| 106 | |
| 107 | For example, consider the following commands: |
| 108 | |
| 109 | [role="term"] |
| 110 | ---------------------------------------------------------------- |
| 111 | lttng enable-event --userspace hello:world |
| 112 | lttng enable-event --userspace hello:world --loglevel=TRACE_INFO |
| 113 | ---------------------------------------------------------------- |
| 114 | |
| 115 | Here, two event rules are created. The first one has a single condition: |
| 116 | the tracepoint name must match `hello:world`. The second one has two |
| 117 | conditions: |
| 118 | |
| 119 | * The tracepoint name must match `hello:world`, _and_ |
| 120 | * The tracepoint's defined log level must be at least as severe as |
| 121 | the `TRACE_INFO` level. |
| 122 | |
| 123 | In this case, the second event rule is pointless because the first one |
| 124 | is more general: it does not care about the tracepoint's log level. |
| 125 | If an event source matching both event rules is reached by the |
| 126 | application's execution, only one event is emitted. |
| 127 | |
| 128 | The available conditions for the Linux kernel domain are: |
| 129 | |
| 130 | * Tracepoint/system call name ('EVENT' argument with |
| 131 | option:--tracepoint or option:--syscall options) or |
| 132 | dynamic probe/function name/address |
| 133 | (option:--probe or option:--function option's argument) which must |
| 134 | match event source's equivalent. |
| 135 | + |
| 136 | Wildcard using the `*` character are supported _at the end_ of |
| 137 | tracepoint and system call names. |
| 138 | |
| 139 | * Filter expression (option:--filter option) executed against the |
| 140 | dynamic values of event fields at execution time that must evaluate |
| 141 | to true. See the <<filter-syntax,Filter expression syntax>> section |
| 142 | below for more information. |
| 143 | |
| 144 | The available conditions for the application domains are: |
| 145 | |
| 146 | * Tracepoint name ('EVENT' with option:--tracepoint option) which must |
| 147 | match event source's equivalent. |
| 148 | + |
| 149 | Wildcard using the `*` character are supported _at the end_ of |
| 150 | tracepoint names. When creating an event rule with a tracepoint name |
| 151 | containing a wildcard, specific tracepoint names can be excluded from |
| 152 | the match using the option:--exclude option. |
| 153 | |
| 154 | * Filter expression (option:--filter option) executed against the |
| 155 | dynamic values of event fields at execution time that must evaluate |
| 156 | to true. See the <<filter-syntax,Filter expression syntax>> section |
| 157 | below for more information. |
| 158 | * Event's log level that must be at least as severe as a given |
| 159 | log level (option:--loglevel option) or match exactly a given log |
| 160 | level (option:--loglevel-only option). |
| 161 | |
| 162 | When using `lttng enable-event` with a set of conditions that does not |
| 163 | currently exist for the chosen tracing session, domain, and channel, |
| 164 | a new event rule is created. Otherwise, the existing event rule is |
| 165 | enabled if it is currently disabled |
| 166 | (see linklttng:lttng-disable-event(1)). |
| 167 | |
| 168 | The option:--all option can be used alongside the option:--tracepoint |
| 169 | or option:--syscall options. When this option is used, no 'EVENT' |
| 170 | argument must be specified. This option defines a single event rule |
| 171 | matching _all_ the possible events of a given tracing domain for the |
| 172 | chosen channel and tracing session. It is the equivalent of an 'EVENT' |
| 173 | argument named `*` (wildcard). |
| 174 | |
| 175 | |
| 176 | [[filter-syntax]] |
| 177 | Filter expression syntax |
| 178 | ~~~~~~~~~~~~~~~~~~~~~~~~ |
| 179 | Filter expressions can be specified with the option:--filter option |
| 180 | when creating a new event rule. If the filter expression evaluates |
| 181 | to true when executed against the dynamic values of an event's fields |
| 182 | when tracing, the filtering condition passes. |
| 183 | |
| 184 | The filter expression syntax is very similar to C language conditional |
| 185 | expressions (expressions that can be evaluated by an `if` statement). |
| 186 | |
| 187 | The following logical operators are supported: |
| 188 | |
| 189 | [width="40%",options="header"] |
| 190 | |===================================== |
| 191 | | Name | Syntax |
| 192 | | Logical negation (NOT) | `!a` |
| 193 | | Logical conjunction (AND) | `a && b` |
| 194 | | Logical disjunction (OR) | `a \|\| b` |
| 195 | |===================================== |
| 196 | |
| 197 | The following comparison operators/relational operators are supported: |
| 198 | |
| 199 | [width="40%",options="header"] |
| 200 | |==================================== |
| 201 | | Name | Syntax |
| 202 | | Equal to | `a == b` |
| 203 | | Not equal to | `a != b` |
| 204 | | Greater than | `a > b` |
| 205 | | Less than | `a < b` |
| 206 | | Greater than or equal to | `a >= b` |
| 207 | | Less than or equal to | `a <= b` |
| 208 | |==================================== |
| 209 | |
| 210 | The arithmetic and bitwise operators are :not: supported. |
| 211 | |
| 212 | The precedence table of the operators above is the same as the one of |
| 213 | the C language. Parentheses are supported to bypass this. |
| 214 | |
| 215 | The dynamic value of an event field is read by using its name as |
| 216 | a C identifier. |
| 217 | |
| 218 | The dynamic value of a statically-known context field is read by |
| 219 | prefixing its name with `$ctx.`. Statically-known context fields are |
| 220 | context fields added to channels without the `$app.` prefix using the |
| 221 | linklttng:lttng-add-context(1) command. |
| 222 | |
| 223 | The dynamic value of an application-specific context field is read by |
| 224 | prefixing its name with `$app.` (follows the format used to add such a |
| 225 | context field with the linklttng:lttng-add-context(1) command). |
| 226 | |
| 227 | When a comparison includes a non existent event field, the whole filter |
| 228 | expression evaluates to false (the event is discarded). |
| 229 | |
| 230 | C integer and floating point number constants are supported, as well as |
| 231 | literal strings between double quotes (`"`). Literal strings can contain |
| 232 | a wildcard character (`*`) at the end to match more than one string. |
| 233 | This wildcard can be escaped using :escwc:. |
| 234 | |
| 235 | LTTng-UST enumeration fields can be compared to integer values (fields |
| 236 | or constants). |
| 237 | |
| 238 | NOTE: Although it is possible to filter the process ID of an event when |
| 239 | the `pid` context has been added to its channel using, for example, |
| 240 | `$ctx.pid == 2832`, it is recommended to use the PID tracker instead, |
| 241 | which is much more efficient (see linklttng:lttng-track(1)). |
| 242 | |
| 243 | Examples: |
| 244 | |
| 245 | ---------------------------- |
| 246 | msg_id == 23 && size >= 2048 |
| 247 | ---------------------------- |
| 248 | |
| 249 | ------------------------------------------------- |
| 250 | $ctx.procname == "lttng*" && (!flag || poel < 34) |
| 251 | ------------------------------------------------- |
| 252 | |
| 253 | --------------------------------------------------------- |
| 254 | $app.my_provider:my_context == 17.34e9 || some_enum >= 14 |
| 255 | --------------------------------------------------------- |
| 256 | |
| 257 | |
| 258 | [[log-levels]] |
| 259 | Log levels |
| 260 | ~~~~~~~~~~ |
| 261 | Tracepoints and log statements in applications have an attached log |
| 262 | level. Application event rules can contain a _log level_ condition. |
| 263 | |
| 264 | With the option:--loglevel option, the event source's log level must |
| 265 | be at least as severe as the option's argument. With the |
| 266 | option:--loglevel-only option, the event source's log level must match |
| 267 | the option's argument. |
| 268 | |
| 269 | The available log levels are: |
| 270 | |
| 271 | User space domain (option:--userspace option):: |
| 272 | Shortcuts such as `system` are allowed. |
| 273 | + |
| 274 | * `TRACE_EMERG` (0) |
| 275 | * `TRACE_ALERT` (1) |
| 276 | * `TRACE_CRIT` (2) |
| 277 | * `TRACE_ERR` (3) |
| 278 | * `TRACE_WARNING` (4) |
| 279 | * `TRACE_NOTICE` (5) |
| 280 | * `TRACE_INFO` (6) |
| 281 | * `TRACE_DEBUG_SYSTEM` (7) |
| 282 | * `TRACE_DEBUG_PROGRAM` (8) |
| 283 | * `TRACE_DEBUG_PROCESS` (9) |
| 284 | * `TRACE_DEBUG_MODULE` (10) |
| 285 | * `TRACE_DEBUG_UNIT` (11) |
| 286 | * `TRACE_DEBUG_FUNCTION` (12) |
| 287 | * `TRACE_DEBUG_LINE` (13) |
| 288 | * `TRACE_DEBUG` (14) |
| 289 | |
| 290 | `java.util.logging` domain (option:--jul option):: |
| 291 | Shortcuts such as `severe` are allowed. |
| 292 | + |
| 293 | * `JUL_OFF` (`INT32_MAX`) |
| 294 | * `JUL_SEVERE` (1000) |
| 295 | * `JUL_WARNING` (900) |
| 296 | * `JUL_INFO` (800) |
| 297 | * `JUL_CONFIG` (700) |
| 298 | * `JUL_FINE` (500) |
| 299 | * `JUL_FINER` (400) |
| 300 | * `JUL_FINEST` (300) |
| 301 | * `JUL_ALL` (`INT32_MIN`) |
| 302 | |
| 303 | Apache log4j domain (option:--log4j option):: |
| 304 | Shortcuts such as `severe` are allowed. |
| 305 | + |
| 306 | * `LOG4J_OFF` (`INT32_MAX`) |
| 307 | * `LOG4J_FATAL` (50000) |
| 308 | * `LOG4J_ERROR` (40000) |
| 309 | * `LOG4J_WARN` (30000) |
| 310 | * `LOG4J_INFO` (20000) |
| 311 | * `LOG4J_DEBUG` (10000) |
| 312 | * `LOG4J_TRACE` (5000) |
| 313 | * `LOG4J_ALL` (`INT32_MIN`) |
| 314 | |
| 315 | Python domain (option:--python option):: |
| 316 | Shortcuts such as `critical` are allowed. |
| 317 | + |
| 318 | * `PYTHON_CRITICAL` (50) |
| 319 | * `PYTHON_ERROR` (40) |
| 320 | * `PYTHON_WARNING` (30) |
| 321 | * `PYTHON_INFO` (20) |
| 322 | * `PYTHON_DEBUG` (10) |
| 323 | * `PYTHON_NOTSET` (0) |
| 324 | |
| 325 | |
| 326 | include::common-cmd-options-head.txt[] |
| 327 | |
| 328 | |
| 329 | Domain |
| 330 | ~~~~~~ |
| 331 | One of: |
| 332 | |
| 333 | option:-j, option:--jul:: |
| 334 | Create or enable event rules in the `java.util.logging` |
| 335 | (JUL) domain. |
| 336 | |
| 337 | option:-k, option:--kernel:: |
| 338 | Create or enable event rules in the Linux kernel domain. |
| 339 | |
| 340 | option:-l, option:--log4j:: |
| 341 | Create or enable event rules in the Apache log4j domain. |
| 342 | |
| 343 | option:-p, option:--python:: |
| 344 | Create or enable event rules in the Python domain. |
| 345 | |
| 346 | option:-u, option:--userspace:: |
| 347 | Create or enable event rules in the user space domain. |
| 348 | |
| 349 | |
| 350 | Target |
| 351 | ~~~~~~ |
| 352 | option:-c, option:--channel='CHANNEL':: |
| 353 | Create or enable event rules in the channel named 'CHANNEL' instead |
| 354 | of the default channel name `channel0`. |
| 355 | |
| 356 | option:-s, option:--session='SESSION':: |
| 357 | Create or enable event rules in the tracing session named 'SESSION' |
| 358 | instead of the current tracing session. |
| 359 | |
| 360 | |
| 361 | Event source type |
| 362 | ~~~~~~~~~~~~~~~~~ |
| 363 | One of: |
| 364 | |
| 365 | option:--function='SOURCE':: |
| 366 | Linux kernel kretprobe. Only available with the option:--kernel |
| 367 | domain option. 'SOURCE' is one of: |
| 368 | + |
| 369 | * Function address (`0x` prefix supported) |
| 370 | * Function symbol |
| 371 | * Function symbol and offset (`SYMBOL+OFFSET` format) |
| 372 | |
| 373 | option:--probe='SOURCE':: |
| 374 | Linux kernel kprobe. Only available with the option:--kernel |
| 375 | domain option. 'SOURCE' is one of: |
| 376 | + |
| 377 | * Address (`0x` prefix supported) |
| 378 | * Symbol |
| 379 | * Symbol and offset (`SYMBOL+OFFSET` format) |
| 380 | |
| 381 | option:--syscall:: |
| 382 | Linux kernel system call. Only available with the option:--kernel |
| 383 | domain option. |
| 384 | |
| 385 | option:--tracepoint:: |
| 386 | Linux kernel or application tracepoint (default). |
| 387 | |
| 388 | |
| 389 | Log level |
| 390 | ~~~~~~~~~ |
| 391 | One of: |
| 392 | |
| 393 | option:--loglevel='LOGLEVEL':: |
| 394 | Add log level condition to the event rule: the event source's |
| 395 | defined log level must be at least as severe as 'LOGLEVEL'. |
| 396 | See the <<log-levels,Log levels>> section above for the available |
| 397 | log levels. Only available with application domains. |
| 398 | |
| 399 | option:--loglevel-only='LOGLEVEL':: |
| 400 | Add log level condition to the event rule: the event source's |
| 401 | defined log level must match 'LOGLEVEL'. See the |
| 402 | <<log-levels,Log levels>> section above for the available log |
| 403 | levels. Only available with application domains. |
| 404 | |
| 405 | |
| 406 | Filtering and exclusion |
| 407 | ~~~~~~~~~~~~~~~~~~~~~~~ |
| 408 | option:-x, option:--exclude='EVENT'[,'EVENT']...:: |
| 409 | Exclude events named 'EVENT' from the event rule. This option |
| 410 | can be used when the command's 'EVENT' argument contains a wildcard |
| 411 | (`*`) to exclude specific names. Only available with application |
| 412 | domains. |
| 413 | |
| 414 | option:-f, option:--filter='EXPR':: |
| 415 | Add filter expression condition to the event rule. Expression 'EXPR' |
| 416 | must evaluate to true when executed against the dynamic values of |
| 417 | event fields. See the <<filter-syntax,Filter expression syntax>> |
| 418 | section above for more information. |
| 419 | |
| 420 | |
| 421 | Shortcuts |
| 422 | ~~~~~~~~~ |
| 423 | option:-a, option:--all:: |
| 424 | Equivalent to an 'EVENT' argument named `*` (wildcard) when also |
| 425 | using the option:--tracepoint (default) or option:--syscall option. |
| 426 | |
| 427 | |
| 428 | include::common-cmd-help-options.txt[] |
| 429 | |
| 430 | |
| 431 | include::common-cmd-footer.txt[] |
| 432 | |
| 433 | |
| 434 | SEE ALSO |
| 435 | -------- |
| 436 | linklttng:lttng-disable-event(1), |
| 437 | linklttng:lttng(1) |