Linux-Trace-Users Archive on lore.kernel.org
 help / color / Atom feed
* Trace event filtering
@ 2019-06-13 17:43 Cong Wang
  2019-06-13 18:02 ` Steven Rostedt
  0 siblings, 1 reply; 3+ messages in thread
From: Cong Wang @ 2019-06-13 17:43 UTC (permalink / raw)
  To: linux-trace-users; +Cc: Steven Rostedt

Hi, all

I have a simple question about filters in libtraceevent. It looks like
libtraceevent parses and matches filters in user-space, but kernel
already implements filtering in kernel-space which is better because
it should prevent events from generating, if not matched. So why
doesn't libtraceevent use kernel filters?

I am trying to filter out non-error block_rq_complete events, clearly
I don't want to see rasdaemon woken up every time for error==0 case,
which is literally all the time.

BTW, the user-space filters have slightly different syntax with
kernel-space filters, at least the regex matching looks slightly
different to me.

Am I miss anything here?

Thanks!

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: Trace event filtering
  2019-06-13 17:43 Trace event filtering Cong Wang
@ 2019-06-13 18:02 ` Steven Rostedt
  2019-06-13 18:33   ` Cong Wang
  0 siblings, 1 reply; 3+ messages in thread
From: Steven Rostedt @ 2019-06-13 18:02 UTC (permalink / raw)
  To: Cong Wang; +Cc: linux-trace-users

On Thu, 13 Jun 2019 10:43:22 -0700
Cong Wang <xiyou.wangcong@gmail.com> wrote:

> Hi, all

Hi Cong,

> 
> I have a simple question about filters in libtraceevent. It looks like
> libtraceevent parses and matches filters in user-space, but kernel
> already implements filtering in kernel-space which is better because
> it should prevent events from generating, if not matched. So why
> doesn't libtraceevent use kernel filters?

The libtraceevent library is made to process the data after it has been
recorded. It is not the library for use of starting the recording,
hence there's no reason to make it use kernel filtering.

> 
> I am trying to filter out non-error block_rq_complete events, clearly
> I don't want to see rasdaemon woken up every time for error==0 case,
> which is literally all the time.

You can do that by this:

  echo 'error != 0' > /sys/kernel/tracing/events/block/block_rq_complete/filter

Note, trace-cmd does this, and we are working on making a libftrace.so
(hopefully it will be out this year) that will allow you to do this
easily from any application.

> 
> BTW, the user-space filters have slightly different syntax with
> kernel-space filters, at least the regex matching looks slightly
> different to me.

Yes, the parsing in the kernel is very limited, but for userspace, we
have the regex (man regex) at our disposal, that the kernel does not
have. Thus, we use that powerful engine. Unfortunately, that means that
the kernel and the userspace filtering will be different.

> 
> Am I miss anything here?

Did that answer all your questions?

-- Steve

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: Trace event filtering
  2019-06-13 18:02 ` Steven Rostedt
@ 2019-06-13 18:33   ` Cong Wang
  0 siblings, 0 replies; 3+ messages in thread
From: Cong Wang @ 2019-06-13 18:33 UTC (permalink / raw)
  To: Steven Rostedt; +Cc: linux-trace-users

On Thu, Jun 13, 2019 at 11:02 AM Steven Rostedt <rostedt@goodmis.org> wrote:
>
> On Thu, 13 Jun 2019 10:43:22 -0700
> Cong Wang <xiyou.wangcong@gmail.com> wrote:
>
> > Hi, all
>
> Hi Cong,
>
> >
> > I have a simple question about filters in libtraceevent. It looks like
> > libtraceevent parses and matches filters in user-space, but kernel
> > already implements filtering in kernel-space which is better because
> > it should prevent events from generating, if not matched. So why
> > doesn't libtraceevent use kernel filters?
>
> The libtraceevent library is made to process the data after it has been
> recorded. It is not the library for use of starting the recording,
> hence there's no reason to make it use kernel filtering.

I see, I thought there is a libtraceevent API to use kernel filters too, so
it is actually designed not to use kernel filters, from what you said.

>
> >
> > I am trying to filter out non-error block_rq_complete events, clearly
> > I don't want to see rasdaemon woken up every time for error==0 case,
> > which is literally all the time.
>
> You can do that by this:
>
>   echo 'error != 0' > /sys/kernel/tracing/events/block/block_rq_complete/filter
>
> Note, trace-cmd does this, and we are working on making a libftrace.so
> (hopefully it will be out this year) that will allow you to do this
> easily from any application.

Yeah, before sending out the question I actually verified that rasdaemon
won't be woken up with that kernel fitler set.

So, I will have to implement this by myself, fortunately it is not hard.

>
> >
> > BTW, the user-space filters have slightly different syntax with
> > kernel-space filters, at least the regex matching looks slightly
> > different to me.
>
> Yes, the parsing in the kernel is very limited, but for userspace, we
> have the regex (man regex) at our disposal, that the kernel does not
> have. Thus, we use that powerful engine. Unfortunately, that means that
> the kernel and the userspace filtering will be different.

Right.

>
> >
> > Am I miss anything here?
>
> Did that answer all your questions?

Yes.

Thanks!

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-13 17:43 Trace event filtering Cong Wang
2019-06-13 18:02 ` Steven Rostedt
2019-06-13 18:33   ` Cong Wang

Linux-Trace-Users Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-trace-users/0 linux-trace-users/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-trace-users linux-trace-users/ https://lore.kernel.org/linux-trace-users \
		linux-trace-users@vger.kernel.org linux-trace-users@archiver.kernel.org
	public-inbox-index linux-trace-users


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-trace-users


AGPL code for this site: git clone https://public-inbox.org/ public-inbox