some payload) being recorded as trace data. This specific condition is
composed of:
- 1. A **domain** (kernel, user space or Java Util Logging) (required).
+ 1. A **domain** (kernel, user space, `java.util.logging`, or log4j)
+ (required).
2. One or many **instrumentation points** in source code or binary
program (tracepoint name, address, symbol name, function name,
- logger name, etc.) to be executed (required).
+ logger name, amongst other types of probes) to be executed
+ (required).
3. A **log level** (each instrumentation point declares its own log
level) or log level range to match (optional; only valid for user
space domain).
4. A **custom user expression**, or **filter**, that must evaluate to
- _true_ when a tracepoint is executed (optional; only valid for user
- space domain).
+ _true_ when a tracepoint is executed (optional).
All conditions are specified using arguments passed to the
`enable-event` command of the `lttng` tool.
-Condition 1 is specified using either `--kernel/-k` (kernel),
-`--userspace/-u` (user space) or `--jul/-j`
-(<abbr title="Java Util Logging">JUL</abbr>). Exactly one of those
-three arguments must be specified.
+Condition 1 is specified using either `--kernel`/`-k` (kernel),
+`--userspace`/`-u` (user space), `--jul`/`-j`
+(<abbr title="java.util.logging">JUL</abbr>), or `--log4j`/`-l` (log4j).
+Exactly one of those four arguments must be specified.
Condition 2 is specified using one of:
lttng enable-event -k --tracepoint gpio_value
lttng enable-event -k --function usb_probe_device usb_probe_device
lttng enable-event -k --syscall --all
+lttng enable-event -k --tracepoint irq_handler_entry \
+ --filter 'irq == 28 || irq == 17'
</pre>
The wildcard symbol, `*`, matches _anything_ and may only be used at
use it between single quotes in your favorite shell to avoid
undesired shell expansion.
+System call events can be enabled individually, too:
+
+<pre class="term" style="position: relative">
+<div class="since">Since 2.6</div>lttng enable-event -k --syscall open
+lttng enable-event -k --syscall read
+lttng enable-event -k --syscall fork,chdir,pipe
+</pre>
+
+The complete list of available system call events can be
+obtained using
+
+<pre class="term">
+lttng list --kernel --syscall
+</pre>
+
You can see a list of events (enabled or disabled) using
<pre class="term">
it from its channel's whitelist. This is why you cannot disable an event
which wasn't previously enabled.
-A disabled event will not generate any trace data, even if all its
+A disabled event doesn't generate any trace data, even if all its
specified conditions are met.
Events may be enabled and disabled at will, either when LTTng tracers