[lttng-dev] On lost events

[Matthew Khouzam]

Quick question. Some traces have overlapping packets, so in that case,
the lost events are between the last event of a previous packet and the
first event of the next packet, which just happens to be the previous
packet's end time?
On 13-07-04 06:29 PM, Mathieu Desnoyers wrote:
> * Matthew Khouzam (matthew.khouzam at ericsson.com) wrote:
>> Hi tracing werewolves,
>>
>> I want to clear up some stuff about lost events.
>>
>> Lost events are caused, in lttng 2.x when the tracer does not have
>> enough memory available to write an event. This can be due to:
>> * events coming in too fast (faster than we can write them)
>> * a given event being too large
>> * we have an event that does a nested wrap around
>>
>> LTTng will not write the whole packet that is lost.
> LTTng does not write an _event_ discarded at all. However, a packet
> "lost" is a different thing: it only happens in overwrite mode, when we
> overwrite a packet.
>
>> It uses a ring
>> buffer and the packet will just be overwritten in the buffer, but a
>> counter will be incremented.
> For an _event_ discarded, we're not even writing it into the buffer.
>
>> The counter is written in the packet header in the CTF trace.
> Indeed, the event lost counters are written in the packet in the ctf
> trace.
>
>> When reading a trace, if you just read the packet headers, you will see
>> something as follows:
>>
>> Packet 1:
>> ts_begin: 100
>> ts_end: 200
>> discarded: 0
>>
>> Packet 2:
>> ts_begin: 300
>> ts_end: 400
>> discarded: 100
>>
>> Packet 3:
>> ts_begin: 500
>> ts_end: 600
>> discarded: 100
>>
>> Packet 4:
>> ts_begin: 650
>> ts_end: 750
>> discarded: 200
>>
>> With this example, the lost events are located between packets 1, 2 and
>> packets 3,4.
>>
>> If the events are too large, they are discarded in the current packet,
>> lttng does not split events into packets (yet?), and this is lost during
>> a current packet.
>>
>> That means if the events are lost between 1 and 2, they are potentially
>> in the range of [200-400] but probably in [200-300]
>> The next lost event are between 3 and 4 (events discarded is a total
>> count, not local to that packet), so 100 events are also lost between
>> [600-750] but likely in between [600-650]. If you can confirm that all
>> events WITH CONTEXTS are smaller than the packet sizes, I think it's a
>> shoe in that it's between the packets and not containing the next packet.
> "and not contained in the next packet".
>
> Thanks,
>
> Mathieu
>
>> Hope this clarifies some issues, it did for me!
>>
>> Matthew
>>
>> _______________________________________________
>> lttng-dev mailing list
>> lttng-dev at lists.lttng.org
>> http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev