<font size=2 face="sans-serif">Hi,</font>
<br>
<br><font size=2 face="sans-serif">I was thinking more about a programmer's
guide to using this mechanism.</font>
<br>
<br><font size=2 face="sans-serif">What I'd like to do is to have Babeltrace
filter events it is showing me from an existing trace.</font>
<br>
<br><font size=2 face="sans-serif">Consider the following example:</font>
<ol>
<li value=1><font size=2 face="sans-serif">There are 3 types of tracepoints
being captured (without filtering):</font>
<ol>
<li value=1><font size=2 face="sans-serif">A debug log message (occasionally)
which includes a "debug_level" value (1..10 with 1 being highest
importance).</font>
<li value=2><font size=2 face="sans-serif">Function entry (via gcc -finstrument-functions
or other instrumentation).</font>
<li value=3><font size=2 face="sans-serif">Function exit (similarly).</font></ol>
<li value=2><font size=2 face="sans-serif">During a 1-hour period, I have
2-3 GB of trace data captured.</font>
<li value=3><font size=2 face="sans-serif">The trace includes events from
4 different processes.</font></ol>
<br><font size=2 face="sans-serif">If I use Babeltrace to read the trace
I will get an enormously big result in text (~30-40GB at least).</font>
<br>
<br><font size=2 face="sans-serif">I would like to be able to do something
like this:</font>
<br>
<br><tt><font size=2>$ babeltrace --filter '$ctx.procname == "smbd"
|| debug_level < 3' /local/lttng-traces/ust/uid/2140/64-bit</font></tt>
<br>
<br><font size=2 face="sans-serif">This would then let me see any events
from the "smbd" process (since i added procname to the context
using lttng add-context) or debug messages from all processes where the
debug level is 1 or 2.</font>
<br>
<br><font size=2 face="sans-serif">Regarding linking - I am referring to
the function </font><tt><font size=2>lttng_enabler_event_link_bytecode()</font></tt><font size=2 face="sans-serif">,
called from </font><tt><font size=2>lttng-ust/liblttng-ust/lttng-events.c</font></tt><font size=2 face="sans-serif">
around line 628.</font>
<br>
<br><font size=2 face="sans-serif">Thanks,</font>
<br>
<br><font size=2 color=#000080 face="sans-serif">Amit Margalit</font>
<br><font size=2 color=#808000 face="sans-serif">IBM XIV </font><font size=2 face="sans-serif">-
<i>Storage Reinvented</i></font>
<br><font size=2 face="sans-serif">XIV-NAS Development Team</font>
<br><font size=2 face="sans-serif">Tel. 03</font><font size=2 face="Arial">-689-7774</font>
<br><font size=2 face="Arial">Fax. 03-689-7230</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Jérémie Galarneau <jeremie.galarneau@efficios.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">Amit Margalit/Israel/IBM@IBMIL</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif">lttng-dev@lists.lttng.org</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">07/18/2013 07:10 PM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: [lttng-dev]
Question about filtering bytecode</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">jeremie.galarneau@gmail.com</font>
<br>
<hr noshade>
<br>
<br>
<br><tt><font size=2>Hi Amit,<br>
<br>
You may find information on the Babeltrace API in babeltrace/doc/API.txt<br>
The filtering mechanism used by the user space tracer is unrelated to<br>
Babeltrace.<br>
<br>
As for the sequence of events, this is how I understand it.<br>
<br>
When invoking the "lttng" binary with --enable-event and a filter<br>
option, a byte code is generated from the filtering rules<br>
(lttng-tools/src/lib/lttng-ctl/lttng-ctl.c:704). This byte code is<br>
then handed off to the session-daemon.<br>
<br>
Then, when an instrumented application is launched and connects to the<br>
session-daemon, it receives the byte code while its events are being<br>
enabled. To answer your question directly, that byte code will be<br>
executed by the tracee when the event is "triggered"<br>
(lttng-ust/liblttng-ust/lttng-filter-interpreter.c:175).<br>
<br>
I'm not sure I understand your question about filter/event linking. A<br>
filter has to be linked to an event since its rules (expressions) are<br>
applied on that event's values. Could you clarify if that's not what<br>
you meant?<br>
<br>
Regards,<br>
Jérémie<br>
<br>
On Thu, Jul 18, 2013 at 3:12 AM, Amit Margalit <AMITM@il.ibm.com>
wrote:<br>
> Hi,<br>
><br>
> I'm considering whether I can write a wrapper for the libbabeltrace
ctf<br>
> iterator which provides a filtered "next()" method.<br>
><br>
> I've started reading the code in the hopes of understanding how to
do this,<br>
> and yet, I'd really appreciate a link to some ordered documentation,
or -<br>
> any other kind of explanation.<br>
><br>
> For example, one thing I still don't understand is the exact sequence,
and<br>
> where the bytecode is actually executed? What is the meaning and purpose
of<br>
> "linking" the filter to an event.<br>
><br>
> Thanks,<br>
><br>
> Amit Margalit<br>
> IBM XIV - Storage Reinvented<br>
> XIV-NAS Development Team<br>
> Tel. 03-689-7774<br>
> Fax. 03-689-7230<br>
> _______________________________________________<br>
> lttng-dev mailing list<br>
> lttng-dev@lists.lttng.org<br>
> </font></tt><a href="http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev"><tt><font size=2>http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev</font></tt></a><tt><font size=2><br>
><br>
<br>
<br>
<br>
-- <br>
Jérémie Galarneau<br>
EfficiOS Inc.<br>
</font></tt><a href=http://www.efficios.com/><tt><font size=2>http://www.efficios.com</font></tt></a><tt><font size=2><br>
<br>
</font></tt>
<br>