* Trace event filtering @ 2019-06-13 17:43 Cong Wang 2019-06-13 18:02 ` Steven Rostedt 0 siblings, 1 reply; 3+ messages in thread From: Cong Wang @ 2019-06-13 17:43 UTC (permalink / raw) To: linux-trace-users; +Cc: Steven Rostedt Hi, all I have a simple question about filters in libtraceevent. It looks like libtraceevent parses and matches filters in user-space, but kernel already implements filtering in kernel-space which is better because it should prevent events from generating, if not matched. So why doesn't libtraceevent use kernel filters? I am trying to filter out non-error block_rq_complete events, clearly I don't want to see rasdaemon woken up every time for error==0 case, which is literally all the time. BTW, the user-space filters have slightly different syntax with kernel-space filters, at least the regex matching looks slightly different to me. Am I miss anything here? Thanks! ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Trace event filtering 2019-06-13 17:43 Trace event filtering Cong Wang @ 2019-06-13 18:02 ` Steven Rostedt 2019-06-13 18:33 ` Cong Wang 0 siblings, 1 reply; 3+ messages in thread From: Steven Rostedt @ 2019-06-13 18:02 UTC (permalink / raw) To: Cong Wang; +Cc: linux-trace-users On Thu, 13 Jun 2019 10:43:22 -0700 Cong Wang <xiyou.wangcong@gmail.com> wrote: > Hi, all Hi Cong, > > I have a simple question about filters in libtraceevent. It looks like > libtraceevent parses and matches filters in user-space, but kernel > already implements filtering in kernel-space which is better because > it should prevent events from generating, if not matched. So why > doesn't libtraceevent use kernel filters? The libtraceevent library is made to process the data after it has been recorded. It is not the library for use of starting the recording, hence there's no reason to make it use kernel filtering. > > I am trying to filter out non-error block_rq_complete events, clearly > I don't want to see rasdaemon woken up every time for error==0 case, > which is literally all the time. You can do that by this: echo 'error != 0' > /sys/kernel/tracing/events/block/block_rq_complete/filter Note, trace-cmd does this, and we are working on making a libftrace.so (hopefully it will be out this year) that will allow you to do this easily from any application. > > BTW, the user-space filters have slightly different syntax with > kernel-space filters, at least the regex matching looks slightly > different to me. Yes, the parsing in the kernel is very limited, but for userspace, we have the regex (man regex) at our disposal, that the kernel does not have. Thus, we use that powerful engine. Unfortunately, that means that the kernel and the userspace filtering will be different. > > Am I miss anything here? Did that answer all your questions? -- Steve ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Trace event filtering 2019-06-13 18:02 ` Steven Rostedt @ 2019-06-13 18:33 ` Cong Wang 0 siblings, 0 replies; 3+ messages in thread From: Cong Wang @ 2019-06-13 18:33 UTC (permalink / raw) To: Steven Rostedt; +Cc: linux-trace-users On Thu, Jun 13, 2019 at 11:02 AM Steven Rostedt <rostedt@goodmis.org> wrote: > > On Thu, 13 Jun 2019 10:43:22 -0700 > Cong Wang <xiyou.wangcong@gmail.com> wrote: > > > Hi, all > > Hi Cong, > > > > > I have a simple question about filters in libtraceevent. It looks like > > libtraceevent parses and matches filters in user-space, but kernel > > already implements filtering in kernel-space which is better because > > it should prevent events from generating, if not matched. So why > > doesn't libtraceevent use kernel filters? > > The libtraceevent library is made to process the data after it has been > recorded. It is not the library for use of starting the recording, > hence there's no reason to make it use kernel filtering. I see, I thought there is a libtraceevent API to use kernel filters too, so it is actually designed not to use kernel filters, from what you said. > > > > > I am trying to filter out non-error block_rq_complete events, clearly > > I don't want to see rasdaemon woken up every time for error==0 case, > > which is literally all the time. > > You can do that by this: > > echo 'error != 0' > /sys/kernel/tracing/events/block/block_rq_complete/filter > > Note, trace-cmd does this, and we are working on making a libftrace.so > (hopefully it will be out this year) that will allow you to do this > easily from any application. Yeah, before sending out the question I actually verified that rasdaemon won't be woken up with that kernel fitler set. So, I will have to implement this by myself, fortunately it is not hard. > > > > > BTW, the user-space filters have slightly different syntax with > > kernel-space filters, at least the regex matching looks slightly > > different to me. > > Yes, the parsing in the kernel is very limited, but for userspace, we > have the regex (man regex) at our disposal, that the kernel does not > have. Thus, we use that powerful engine. Unfortunately, that means that > the kernel and the userspace filtering will be different. Right. > > > > > Am I miss anything here? > > Did that answer all your questions? Yes. Thanks! ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-06-13 18:33 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-06-13 17:43 Trace event filtering Cong Wang 2019-06-13 18:02 ` Steven Rostedt 2019-06-13 18:33 ` Cong Wang
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).