[lttng-dev] On lost events

[Mathieu Desnoyers]

* Matthew Khouzam (matthew.khouzam at ericsson.com) wrote:
> Hi tracing werewolves,
> 
> I want to clear up some stuff about lost events.
> 
> Lost events are caused, in lttng 2.x when the tracer does not have
> enough memory available to write an event. This can be due to:
> * events coming in too fast (faster than we can write them)
> * a given event being too large
> * we have an event that does a nested wrap around
> 
> LTTng will not write the whole packet that is lost.

LTTng does not write an _event_ discarded at all. However, a packet
"lost" is a different thing: it only happens in overwrite mode, when we
overwrite a packet.

> It uses a ring
> buffer and the packet will just be overwritten in the buffer, but a
> counter will be incremented.

For an _event_ discarded, we're not even writing it into the buffer.

> The counter is written in the packet header in the CTF trace.

Indeed, the event lost counters are written in the packet in the ctf
trace.

> 
> When reading a trace, if you just read the packet headers, you will see
> something as follows:
> 
> Packet 1:
> ts_begin: 100
> ts_end: 200
> discarded: 0
> 
> Packet 2:
> ts_begin: 300
> ts_end: 400
> discarded: 100
> 
> Packet 3:
> ts_begin: 500
> ts_end: 600
> discarded: 100
> 
> Packet 4:
> ts_begin: 650
> ts_end: 750
> discarded: 200
> 
> With this example, the lost events are located between packets 1, 2 and
> packets 3,4.
> 
> If the events are too large, they are discarded in the current packet,
> lttng does not split events into packets (yet?), and this is lost during
> a current packet.
> 
> That means if the events are lost between 1 and 2, they are potentially
> in the range of [200-400] but probably in [200-300]
> The next lost event are between 3 and 4 (events discarded is a total
> count, not local to that packet), so 100 events are also lost between
> [600-750] but likely in between [600-650]. If you can confirm that all
> events WITH CONTEXTS are smaller than the packet sizes, I think it's a
> shoe in that it's between the packets and not containing the next packet.

"and not contained in the next packet".

Thanks,

Mathieu

> 
> Hope this clarifies some issues, it did for me!
> 
> Matthew
> 
> _______________________________________________
> lttng-dev mailing list
> lttng-dev at lists.lttng.org
> http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev

-- 
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com