From mboxrd@z Thu Jan  1 00:00:00 1970
From: pierre-marc.fournier@polymtl.ca (Pierre-Marc Fournier)
Date: Fri, 24 Oct 2008 10:48:14 -0400
Subject: [ltt-dev] kernel_arch_syscall_exit
In-Reply-To: <8d94e9280810240654w739ac0cp136965882c4ab219@mail.gmail.com>
References: <8d94e9280810240350s21c24b77ka351781285ae052a@mail.gmail.com>	<20081024134255.GA22644@Krystal>
	<8d94e9280810240654w739ac0cp136965882c4ab219@mail.gmail.com>
Message-ID: <4901E02E.9000506@polymtl.ca>

Gian Lorenzo Meocci wrote:
> I am testing LTTng 0.44 with last lttv 0.11.3.
> 
> My trace is even like this:
> 
> fs_exec: 583.329460188 (/tmp/trace1/control/processes_0), 30279,
> 30279, ./OCEAN, , 30253, 0x0, SYSCALL { filename = "./OCEAN" }
> kernel_syscall_exit: 583.329461613 (/tmp/trace1/cpu_0), 30279, 30279,
> ./OCEAN, , 30253, 0x0, USER_MODE { ret = 0 }
> kernel_arch_trap_exit: 583.361027971 (/tmp/trace1/cpu_0), 30279,
> 30279, ./OCEAN, , 30253, 0x0, USER_MODE
> kernel_arch_trap_entry: 583.361029692 (/tmp/trace1/cpu_0), 30279,
> 30279, ./OCEAN, , 30253, 0x0, TRAP { trap_id = 14, ip = 0x8079800 }
> 

syscall_entry would come before fs_exec. fs_exec is an event that occurs
between syscall_entry and syscall_exit in the particular case where this
syscall is an exec(). So you need to look before this sequence to find
the syscall_entry.