[ltt-dev] kernel_arch_syscall_exit

[Pierre-Marc Fournier]

Gian Lorenzo Meocci wrote:
> I am testing LTTng 0.44 with last lttv 0.11.3.
> 
> My trace is even like this:
> 
> fs_exec: 583.329460188 (/tmp/trace1/control/processes_0), 30279,
> 30279, ./OCEAN, , 30253, 0x0, SYSCALL { filename = "./OCEAN" }
> kernel_syscall_exit: 583.329461613 (/tmp/trace1/cpu_0), 30279, 30279,
> ./OCEAN, , 30253, 0x0, USER_MODE { ret = 0 }
> kernel_arch_trap_exit: 583.361027971 (/tmp/trace1/cpu_0), 30279,
> 30279, ./OCEAN, , 30253, 0x0, USER_MODE
> kernel_arch_trap_entry: 583.361029692 (/tmp/trace1/cpu_0), 30279,
> 30279, ./OCEAN, , 30253, 0x0, TRAP { trap_id = 14, ip = 0x8079800 }
> 

syscall_entry would come before fs_exec. fs_exec is an event that occurs
between syscall_entry and syscall_exit in the particular case where this
syscall is an exec(). So you need to look before this sequence to find
the syscall_entry.