Hello all,

I hope you are doing well.

I have a quick question about LTTng tracking when using kernel probes. I mainly use LTTng to trace file system functions in the Linux kernel, and for that I use the LTTng kernel probe feature, which works very well. However, when I tried filtering logs for a specific group ID, I noticed that filters are not supported for kernel probes.

Then I attempted to use the tracking feature to trace only a specific GID, but this also did not work. From what I see in my logs, it appears that for kernel probes all events are captured and recorded, regardless of the tracking options.

I wanted to know if this is a known limitation, and whether there is any in-progress work or reason why this is not currently supported.

For reference, here is my code. I am using LTTng 2.13.11 with kernel 6.8.0-101-generic:

``` #!/bin/sh
SESSION_NAME="lttng-gid-test"
OUTPUT_DIR="/tmp/lttng/${SESSION_NAME}"
GROUP_ID=1002

# create the lttng session
lttng create "$SESSION_NAME" -o "$OUTPUT_DIR"

# create the lttng ring buffer channel
lttng enable-channel --session="$SESSION_NAME" --kernel channel0 \
--subbuf-size=16M \
--num-subbuf=2

# add pid, tid, proc, and gid for tracing collection
lttng add-context --session="$SESSION_NAME" --channel=channel0 --kernel --type pid
lttng add-context --session="$SESSION_NAME" --channel=channel0 --kernel --type gid

# enable the target probe
lttng enable-event --session="$SESSION_NAME" --channel=channel0 --kernel --probe=ext4_get_inode_loc ext4_get_inode_loc

# disable all tracks # NOTE: untracking doesn't make a difference
# lttng untrack --session="$SESSION_NAME" --kernel --all --gid
# lttng untrack --session="$SESSION_NAME" --kernel --all --pid
# lttng untrack --session="$SESSION_NAME" --kernel --all --vpid
# lttng untrack --session="$SESSION_NAME" --kernel --all --uid
# lttng untrack --session="$SESSION_NAME" --kernel --all --vuid
# lttng untrack --session="$SESSION_NAME" --kernel --all --vgid

# only enable gid 1002 track
lttng track --kernel --gid=1002

# start lttng lttng start $SESSION_NAME

```

Thank you for your time and guidance.

Best regards,
Amir

--
Amirhossein Najafizadeh
PhD Student, Computer Science Department, Stony Brook University, N.Y.
File systems and Storage Lab (FSL)

najafizadeh21@gmail.com
https://amirhnajafiz.github.io/