Re: Trace event filtering

[Steven Rostedt <rostedt@goodmis.org>]

On Thu, 13 Jun 2019 10:43:22 -0700
Cong Wang <xiyou.wangcong@gmail.com> wrote:

> Hi, all

Hi Cong,

> 
> I have a simple question about filters in libtraceevent. It looks like
> libtraceevent parses and matches filters in user-space, but kernel
> already implements filtering in kernel-space which is better because
> it should prevent events from generating, if not matched. So why
> doesn't libtraceevent use kernel filters?

The libtraceevent library is made to process the data after it has been
recorded. It is not the library for use of starting the recording,
hence there's no reason to make it use kernel filtering.

> 
> I am trying to filter out non-error block_rq_complete events, clearly
> I don't want to see rasdaemon woken up every time for error==0 case,
> which is literally all the time.

You can do that by this:

  echo 'error != 0' > /sys/kernel/tracing/events/block/block_rq_complete/filter

Note, trace-cmd does this, and we are working on making a libftrace.so
(hopefully it will be out this year) that will allow you to do this
easily from any application.

> 
> BTW, the user-space filters have slightly different syntax with
> kernel-space filters, at least the regex matching looks slightly
> different to me.

Yes, the parsing in the kernel is very limited, but for userspace, we
have the regex (man regex) at our disposal, that the kernel does not
have. Thus, we use that powerful engine. Unfortunately, that means that
the kernel and the userspace filtering will be different.

> 
> Am I miss anything here?

Did that answer all your questions?

-- Steve