Update quickstart, describing syscall events

[lttng-tools.git] / doc / quickstart.txt

NOTES:
--------------
2011-07-21 : User-space tracer is not released. Tracing in user-space at this
point is not possible with lttng-tools.

QUICKSTART
--------------

This is a quick start guide for the complete LTTng tool chain. This is divided
in three sections respectively kernel tracing, user-space tracing and reading a
trace.

See the README file for installation procedure or use the various Linux
distribution packages.

In order to trace the kernel, you'll need the lttng-modules >= 2.0 compiled and
installed. See http://lttng.org/lttng2.0 for more instructions for that part.
For user-space tracing, you'll need an instrumented application, please see
http://lttng.org/ust.

lttng-tools provide a session daemon (ltt-sessiond) that acts as a tracing
registry. To trace any instrumented applications or the kernel, a registered
tracing session is needed beforehand. To interact with the session daemon and a
tracing session, you should use the lttng command line UI (lttng).

Here is a list of some powerful features the LTTng 2.0 kernel tracer offers:

	* Kprobes support
	* Function Tracer support
	* Context information support (add context data to an event)
	* Perf counter support
	* Tracepoint support

The next sections explain how to do tracing :)

Kernel Tracing
--------------

You can start the session daemon by invoking the command "ltt-sessiond",
or let the lttng command line tool do it for you. The session daemon
loads the LTTng tracer modules for you if those modules can be found on
your system. If they are not found, the kernel tracing feature will be
unavailable.

List available kernel events:

# lttng list -k

1) Create a tracing session. A .lttngrc will be created in $HOME containing
the session name (here 'mysession') you are working on.

# lttng create mysession

If you have multiple sessions, you can change the current session by using

# lttng set-session myothersession

2) Enable tracepoint event(s). Here for example, we want only
'sched_switch' and 'sched_wakeup' events for the kernel (-k/--kernel).

# lttng enable-event sched_switch,sched_wakeup -k

or enable ALL tracepoint events (-a/--all):

# lttng enable-event -a -k

3) Enable all system call event(s).

# lttng enable-event -a -k --syscall

4) Enable kprobes and/or the function tracer with lttng

This is a new feature made possible by the new LTTng 2.0 kernel tracer. You can
enable a dynamic probe and data will be output in the trace along side with
your tracing data.

# lttng enable-event aname -k --probe symbol+0xffff7260695

or

# lttng enable-event aname -k --probe 0xffff7260695

Either an <address> or a <symbol+offset> can be used for probes.

You can also enable function tracer, which uses the Ftrace API (by Steven
Rostedt). Again, data will be output in the trace.

# lttng enable-event aname -k --function <symbol_name>

5) Enable context information for an event:

This is also a new feature which allows you to add context information to an
event. For example, you can add the PID along with the event information:

# lttng add-context -k -e sched_switch -t pid

At this point, you will have to look at 'lttng add-context --help' for all
possible context type which are integer values.

You can on the same line activate multiple context:

# lttng add-context -k -e sched_switch -t pid -t nice -t tid

6) Enable perf counter for an event:

Again, a new powerful feature is the possibility to add perf counter data
(using the perf API by Ingo Molnar and Thomas Gleixner) to the trace on a per
event basis. Let say we want to get the CPU cycles at each event:

# lttng add-context -k -e sched_switch -t perf:cpu-cycles

You'll have to use the add-context help for all possible perf counter values.

7) Start tracing:

# lttng start

Tracing is in progress at this point and traces will be written in
$HOME/lttng-traces/mysession-<date>-<time>

8) Stop tracing:

# lttng stop

Note: At this point, you can restart the trace (lttng start), enable/disable
events or just go take a break and come back 3 days later to start it again :).

9) Destroy your session after you are done with tracing

# lttng destroy

See Reading a trace section below to read you trace(s).

User-space Tracing
--------------

User-space tracer 2.0 not released at this point. For the 0.x versions,
you need to use 'ustctl' to control user-space tracing.

Reading a trace
--------------

The tool "Babeltrace" can be used to dump your binary trace into a
human-readable text format. Please see
http://www.efficios.com/babeltrace and git tree
http://git.efficios.com/?p=babeltrace.git

# babeltrace -n $HOME/lttng-traces/mysession-<date>-<time> | less

Voilà!

Please report any bugs/comments on our mailing list
(ltt-dev@lists.casi.polymtl.ca) or you can go on our IRC channel at
irc.oftc.net, channel #lttng