Trace event filtering

Trace event filtering

[Cong Wang]

Hi, all

I have a simple question about filters in libtraceevent. It looks like
libtraceevent parses and matches filters in user-space, but kernel
already implements filtering in kernel-space which is better because
it should prevent events from generating, if not matched. So why
doesn't libtraceevent use kernel filters?

I am trying to filter out non-error block_rq_complete events, clearly
I don't want to see rasdaemon woken up every time for error==0 case,
which is literally all the time.

BTW, the user-space filters have slightly different syntax with
kernel-space filters, at least the regex matching looks slightly
different to me.

Am I miss anything here?

Thanks!

Re: Trace event filtering

[Steven Rostedt]

On Thu, 13 Jun 2019 10:43:22 -0700
Cong Wang <xiyou.wangcong@gmail.com> wrote:

> Hi, all

Hi Cong,

> 
> I have a simple question about filters in libtraceevent. It looks like
> libtraceevent parses and matches filters in user-space, but kernel
> already implements filtering in kernel-space which is better because
> it should prevent events from generating, if not matched. So why
> doesn't libtraceevent use kernel filters?

The libtraceevent library is made to process the data after it has been
recorded. It is not the library for use of starting the recording,
hence there's no reason to make it use kernel filtering.

> 
> I am trying to filter out non-error block_rq_complete events, clearly
> I don't want to see rasdaemon woken up every time for error==0 case,
> which is literally all the time.

You can do that by this:

  echo 'error != 0' > /sys/kernel/tracing/events/block/block_rq_complete/filter

Note, trace-cmd does this, and we are working on making a libftrace.so
(hopefully it will be out this year) that will allow you to do this
easily from any application.

> 
> BTW, the user-space filters have slightly different syntax with
> kernel-space filters, at least the regex matching looks slightly
> different to me.

Yes, the parsing in the kernel is very limited, but for userspace, we
have the regex (man regex) at our disposal, that the kernel does not
have. Thus, we use that powerful engine. Unfortunately, that means that
the kernel and the userspace filtering will be different.

> 
> Am I miss anything here?

Did that answer all your questions?

-- Steve

Re: Trace event filtering

[Cong Wang]

On Thu, Jun 13, 2019 at 11:02 AM Steven Rostedt <rostedt@goodmis.org> wrote:
>
> On Thu, 13 Jun 2019 10:43:22 -0700
> Cong Wang <xiyou.wangcong@gmail.com> wrote:
>
> > Hi, all
>
> Hi Cong,
>
> >
> > I have a simple question about filters in libtraceevent. It looks like
> > libtraceevent parses and matches filters in user-space, but kernel
> > already implements filtering in kernel-space which is better because
> > it should prevent events from generating, if not matched. So why
> > doesn't libtraceevent use kernel filters?
>
> The libtraceevent library is made to process the data after it has been
> recorded. It is not the library for use of starting the recording,
> hence there's no reason to make it use kernel filtering.

I see, I thought there is a libtraceevent API to use kernel filters too, so
it is actually designed not to use kernel filters, from what you said.

>
> >
> > I am trying to filter out non-error block_rq_complete events, clearly
> > I don't want to see rasdaemon woken up every time for error==0 case,
> > which is literally all the time.
>
> You can do that by this:
>
>   echo 'error != 0' > /sys/kernel/tracing/events/block/block_rq_complete/filter
>
> Note, trace-cmd does this, and we are working on making a libftrace.so
> (hopefully it will be out this year) that will allow you to do this
> easily from any application.

Yeah, before sending out the question I actually verified that rasdaemon
won't be woken up with that kernel fitler set.

So, I will have to implement this by myself, fortunately it is not hard.

>
> >
> > BTW, the user-space filters have slightly different syntax with
> > kernel-space filters, at least the regex matching looks slightly
> > different to me.
>
> Yes, the parsing in the kernel is very limited, but for userspace, we
> have the regex (man regex) at our disposal, that the kernel does not
> have. Thus, we use that powerful engine. Unfortunately, that means that
> the kernel and the userspace filtering will be different.

Right.

>
> >
> > Am I miss anything here?
>
> Did that answer all your questions?

Yes.

Thanks!