Recent Advances in Linux Tracing
summary
Kernel-level dynamic tracing uses kprobes and uprobes for on-the-fly probes, with return probes added in 3.10 and architecture work (ARM) still outstanding. ftrace gains instances and function triggers to create multiple buffers and start/stop traces on specific functions. perf builds on kprobes for profiling, adds perf mem and perf probe, and is getting perf ftrace/devtrace patches (five patch revisions so far). User-space options include systemtap, LTTng, ktop/ktap landed in 3.13, and an x86_64 DTrace port (user-space static probes, v0.4 beta) available from Oracle.
AI-written summary · about
chapters (31)
- 0:00Intro
- 0:45Kprobes: Dynamic Kernel Tracing
- 2:15Events Markers: Static Kernel Tracing
- 3:28Tracepoints: Details
- 5:44Uprobes: Dynamic Userspace Tracing
- 6:37Uprobes: Details
- 9:05Uprobes and Uretprobes: Status
- 10:20Ftrace: Some Background
- 12:43Ftrace: Build Configuration
- 13:03Ftrace: Control and Output
- 14:49Ftrace: Tracers (Plugins)
- 15:42Ftrace: Dynamic Tracing (Kernel & User)
- 19:00Ftrace: Function Triggers
- 21:23Ftrace: In 3.11 and 3.12
- 22:23Ftrace: Event Triggers (WIP)
- 27:15Perf: Types of events
- 27:56Other Control Parameters
- 28:24Perf: Dynamic Tracing (Kernel & User)
- 31:41Upcoming: Ftrace and Perf Integration
- 32:59Perf ftrace: More Control Parameters
- 33:27Perf WIP: Support for SDT Markers
- 34:25Perf: Persistent Events (WIP)
- 35:20Perf: Toggle Events (WIP)
- 36:00Some Stats
- 38:16SystemTap
- 42:41DTrace on Linux: Background
- 44:35DTrace on Linux: Current Functionality
- 46:25Dtrace USDT Example
- 46:42Example: Instrumented C Program
- 46:56Example: Output
- 47:46Tracing: General Open Issues
related talks
35mLinux Tracing updates
41mLinux Tracing Techniques
34mTracing: The Bane of You Security Folks
37mKernel and userspace tracing with LTTng and friends
31mFantastic tracepoints and where to find them
13mFast (Trapless) Kernel Probes Everywhere
30mDTrace at 21: Reflections on Fully-grown Software
25mKernel tracing with BPF