LTTng: Beyond Ring-Buffer Based Tracing
summary
LTTng now supports triggers that evaluate event-rule filters at the tracepoint, send notifications (including selected payload fields) to external listeners, and automatically capture in-memory snapshots or rotate/stop sessions when conditions match; this lets monitoring systems start detailed tracing only when a rare failure occurs. It also adds aggregation maps: per-CPU arrays of counters addressable by named keys so user space can count events cheaply. Recorded performance moves from ~160 ns per user-space ring-buffer event to ~43 ns when incrementing a map, and kernel maps show similar low overhead.
AI-written summary · about
chapters (15)
- 0:00Start
- 1:05Introduction of Lttng
- 1:27What Is Ltng
- 4:28User Space Tracer
- 7:20Ring Buffer Tracing
- 9:49Event Rule System
- 12:16Debugging
- 14:30Snapshot Based Profiling
- 16:26Triggers
- 19:23Demo
- 22:32Capturing Value
- 28:14Aggregation
- 29:29Aggregation Maps
- 34:02Pattern Matching
- 35:04Histograms
related talks
48mEfficient and Large-scale Infrastructure Monitoring With Tracing
36mLTTNG-UST Efficient System Wide User-Space Tracing
37mKernel and userspace tracing with LTTng and friends
27mBeyond OTLP: Unlocking the Potential of OS-native Tracing
52mTracking Down What Happened: A Comparison of Tracing Solutions
35mLinux Tracing updates
49mAdding Inter-event Capabilities to Linux Kernel Trace Events
11mImproved TiKV Observability: How We Trace Events under Nanoseconds Latency