From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id +KacKOJ4219GTAAAWB0awg (envelope-from ) for ; Thu, 17 Dec 2020 10:27:30 -0500 Received: by simark.ca (Postfix, from userid 112) id 8C2321F0AA; Thu, 17 Dec 2020 10:27:30 -0500 (EST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-1.1 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HTML_MESSAGE,MAILING_LIST_MULTI,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 Received: from lists.lttng.org (lists.lttng.org [167.114.26.123]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id D1B441E965 for ; Thu, 17 Dec 2020 10:27:29 -0500 (EST) Received: from lists-lttng01.efficios.com (localhost [IPv6:::1]) by lists.lttng.org (Postfix) with ESMTP id 4CxbTY2KHVzFK1; Thu, 17 Dec 2020 10:27:29 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=lists.lttng.org; s=default; t=1608218849; bh=NC42Jh0CVYA+0MvT++Pwq4r5A/mE/GMX323TsnHU/yk=; h=Date:To:Cc:In-Reply-To:References:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=rkjHwlQjorX0sFIdjMsFjkSCuRn8h/f9vr7hmrgkJOa24jbRlUjGq7QSxp2WicpPL pr9FSG7z9BjokJKg4SC5BU9YO+aNExaPRNjP0NQvEYNPLVAQAeyIB3EVVY7J89PMyV rhLElnhFM/M0V5c5Pf0M+pA9GznCs69zp9KJ27O37622pavAqprcucGsrOptd9XCQH akUU7oQEcWjePSi4tUaFtITFT45VqCekZIvl3j2i/Wq1B9E86OI4gkLqfR2FSzRQ3A 3PR5RwFSEQWAZv9UKEoFhNkhZhxUyNMhVCgy+dTVqOvgyCGRzFpFiEv6bKuOWqYmRc pTARgOamUN7Aw== Received: from mail.efficios.com (mail.efficios.com [167.114.26.124]) by lists.lttng.org (Postfix) with ESMTPS id 4CxbTX1gjkzFCy for ; Thu, 17 Dec 2020 10:27:28 -0500 (EST) Received: from localhost (localhost [127.0.0.1]) by mail.efficios.com (Postfix) with ESMTP id B0C3B2A40A1 for ; Thu, 17 Dec 2020 10:27:27 -0500 (EST) Received: from mail.efficios.com ([127.0.0.1]) by localhost (mail03.efficios.com [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id a1RgWFKMvWir; Thu, 17 Dec 2020 10:27:27 -0500 (EST) Received: from localhost (localhost [127.0.0.1]) by mail.efficios.com (Postfix) with ESMTP id 5F9412A40A0; Thu, 17 Dec 2020 10:27:27 -0500 (EST) DKIM-Filter: OpenDKIM Filter v2.10.3 mail.efficios.com 5F9412A40A0 X-Virus-Scanned: amavisd-new at efficios.com Received: from mail.efficios.com ([127.0.0.1]) by localhost (mail03.efficios.com [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id VMM__6YUuidG; Thu, 17 Dec 2020 10:27:27 -0500 (EST) Received: from mail03.efficios.com (mail03.efficios.com [167.114.26.124]) by mail.efficios.com (Postfix) with ESMTP id 51D382A3CCD; Thu, 17 Dec 2020 10:27:27 -0500 (EST) Date: Thu, 17 Dec 2020 10:27:27 -0500 (EST) To: Serica Cc: lttng-dev Message-ID: <829410434.7017.1608218847209.JavaMail.zimbra@efficios.com> In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [167.114.26.124] X-Mailer: Zimbra 8.8.15_GA_3980 (ZimbraWebClient - FF83 (Linux)/8.8.15_GA_3980) Thread-Topic: Possibilities to customize lttng tracepoints in kernel space Thread-Index: du8MC3RhZd5l0VHnHIvWFzHIm+M5XA== Subject: Re: [lttng-dev] Possibilities to customize lttng tracepoints in kernel space X-BeenThere: lttng-dev@lists.lttng.org X-Mailman-Version: 2.1.31 Precedence: list List-Id: LTTng development list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Mathieu Desnoyers via lttng-dev Reply-To: Mathieu Desnoyers Content-Type: multipart/mixed; boundary="===============8769167294035375815==" Errors-To: lttng-dev-bounces@lists.lttng.org Sender: "lttng-dev" --===============8769167294035375815== Content-Type: multipart/alternative; boundary="=_97c702d8-131f-4bc1-9128-4d2981d4e6b1" --=_97c702d8-131f-4bc1-9128-4d2981d4e6b1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit ----- On Dec 16, 2020, at 4:19 AM, lttng-dev wrote: > Hi, > I send this email to consult that whether it is possible to customize lttng > tracepoints in kernel space. I have learnt that lttng leverages linux > tracepoint to collect audit logs like system calls. Also, I have found that > user can define their customized tracepoints in user space by using lttng-ust > so that they can trace their user applications. > Is it possible for lttng users to customize the existing tracepoints in kernel > space? For example, after the system call sys_clone, or read, called and then > collected by lttng, I want to process some data ( e.g., the return value of the > syscall ), and place the result in a new field in the audit log ( or using > another approach, by emitting a new type of event in the audit log ), and later > when parsed by babeltrace, we can see the newly-added field or event in the > parsed result. > Looking forward to your reply. Hi, You will want to start by having a look at this section of the LTTng documentation: https://lttng.org/docs/v2.12/#doc-instrumenting-linux-kernel You can indeed modify lttng-modules to change the fields gathered by the system call tracing facility (see include/instrumentation/syscalls/README section (3)). Those changes will be reflected in the resulting trace data. Thanks, Mathieu > Best wishes, > Serica > _______________________________________________ > lttng-dev mailing list > lttng-dev@lists.lttng.org > https://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev -- Mathieu Desnoyers EfficiOS Inc. http://www.efficios.com --=_97c702d8-131f-4bc1-9128-4d2981d4e6b1 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable


----- On Dec 16, 2020, at 4:19 AM, lttng-= dev <lttng-dev@lists.lttng.org> wrote:
Hi,

I send this email to consult that whether it = is possible to customize lttng tracepoints in kernel space. I have learnt t= hat lttng leverages linux tracepoint to collect audit logs like system call= s. Also, I have found that user can define their customized tracepoints in = user space by using lttng-ust so that they can trace their user application= s.

Is it possible for lttng users to customize the existing t= racepoints in kernel space? For example, after the system call sys_clone, o= r read, called and then collected by lttng, I want to process some data ( e= .g., the return value of the syscall ), and place the result in a new field= in the audit log ( or using another approach, by emitting a new type of ev= ent in the audit log ), and later when parsed by babeltrace, we can see the= newly-added field or event in the parsed result.

Looking for= ward to your reply.

Hi,

You will want to = start by having a look at this section of the LTTng documentation: https://= lttng.org/docs/v2.12/#doc-instrumenting-linux-kernel

You can indeed modify lttn= g-modules to change the fields gathered by the system call tracing facility= (see include/instrumentation/syscalls/README section (3)).
Those= changes will be reflected in the resulting trace data.

Thanks,

Mathieu


--
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com
=
--=_97c702d8-131f-4bc1-9128-4d2981d4e6b1-- --===============8769167294035375815== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ lttng-dev mailing list lttng-dev@lists.lttng.org https://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev --===============8769167294035375815==--