[lttng-dev] Extract lttng trace from kernel coredump
minyard at acm.org
Sat Jan 18 13:29:52 EST 2014
On 01/18/2014 10:47 AM, Mathieu Desnoyers wrote:
> ----- Original Message -----
>> From: "Corey Minyard" <minyard at acm.org>
>> To: "David Goulet" <dgoulet at efficios.com>
>> Cc: lttng-dev at lists.lttng.org
>> Sent: Tuesday, January 14, 2014 3:39:43 PM
>> Subject: Re: [lttng-dev] Extract lttng trace from kernel coredump
>> On 01/14/2014 12:42 PM, David Goulet wrote:
>>> On 13 Jan (16:39:47), Corey Minyard wrote:
>>>> I'm working on a feature to allow an lttng trace to be extracted from a
>>>> kernel coredump, and I'm wondering the best way to proceed. I've looked
>>>> at extracting from the existing data structures, but that would require
>>>> something to always have a trace file open and it looks more than a
>>>> little complicated. I was thinking instead of having a different trace
>>>> channel for configuring this coredump and some globals to point to the
>>>> various data structures. Would that be the best way to pursue this? Is
>>>> there a better way, perhaps?
>>> Oh yes we do actually already have a way to do that :)
>>> Please see:
>>> With the snapshot feature, it's quite easy to do that. Hope that helps
>>> you with what you are trying to achieve.
>> I did see that, but it seems to be for an application coredump. I was
>> looking for something that would work for a kernel coredump. So that if
>> the kernel crashes, you can use kdump to extract the kernel core and
>> then extract the LTT buffers from that. The idea is that if the kernel
>> crashes, you can get some idea of what was happening before the crash.
> Something along these lines have been proposed a while back on the ML,
> but it was against an old LTTng version (0.x):
> It might be interesting to adapt it to the newer LTTng 2.x. Anyone interested
> to look into this ?
That was done by a colleague of mine. However, things appear to have
changed so much since then that it doesn't seem simple to extract a
trace from memory. It could be done, but I'm currently looking at
adding a separate transport that writes to a simpler per-core circular
data structure and doesn't actually ever generate any output. Since it
doesn't generate any output, it can be much simpler.
But I am certainly open to suggestions on how to do this, and happy to
have anything included back into the mainline.
And I'm still learning about the internals of LTT.
More information about the lttng-dev