8 lttng-event-rule - Common LTTng event rule specification
13 Specify an event rule to match Linux kernel tracepoint or system call
17 option:--domain=**kernel** option:--type=(**tracepoint** | **syscall**[**:entry**|**:exit**|**pass:[:entry+exit]**])]
18 pass:[[]option:--name='NAME'] [option:--filter='EXPR']
20 Specify an event rule to match Linux kernel kprobe or user space
24 option:--domain=**kernel** option:--type=(**kprobe** | **uprobe**) option:--location='LOC'
25 pass:[[]option:--event-name='EVENTNAME']
27 Specify an event rule to match user space tracepoint events:
30 option:--domain=**user** [option:--type=**tracepoint**] [option:--name='NAME'] [option:--exclude-name='XNAME']...
31 pass:[[]option:--log-level=('LOGLEVEL' | 'LOGLEVEL'.. | ..)] [option:--filter='EXPR']
33 Specify an event rule to match Java/Python logging events:
36 option:--domain=(**jul** | **log4j** | **python**) [option:--type=**logging**] [option:--name='NAME']
37 pass:[[]option:--log-level=('LOGLEVEL' | 'LOGLEVEL'.. | ..)] [option:--filter='EXPR']
42 This manual page shows how to specify an LTTng event rule on the command
45 As of LTTng{nbsp}{lttng_version}, the command-line options documented
46 here only apply to the `event-rule-matches` trigger condition specifier
47 (see man:lttng-add-trigger(1)).
49 See man:lttng-concepts(7) to learn more about instrumentation points,
50 events, and event rules.
54 This manual page only describes the common event rule options. The
55 man:lttng(1) commands which require an event rule specification may
56 accept or require other options and arguments, depending on the context.
58 For example, the man:lttng-add-trigger(1) command also accepts
59 nloption:--capture options with the `event-rule-matches` trigger
64 Overview of event rule condtions
65 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
66 For LTTng to emit an event{nbsp}__E__,{nbsp}__E__ must satisfy *all* the
67 conditions of an event rule, that is:
69 * The instrumentation point from which LTTng creates{nbsp}__E__ has a
72 See the <<inst-point-type-cond,Instrumentation point type condition>>
75 * A pattern matches the name of{nbsp}__E__ while another pattern
78 See the <<event-name-cond,Event name condition>> section below.
80 * The log level of the instrumentation point from which LTTng
81 creates{nbsp}__E__ is at least as severe as some value, or is exactly
84 See the <<inst-point-log-level-cond,Instrumentation point log level
85 condition>> section below.
87 * The fields of the payload of{nbsp}__E__ and the current context fields
88 satisfy a filter expression.
90 See the <<filter-cond,Event payload and context filter condition>>
93 The dedicated command-line options of most conditions are optional: if
94 you don't specify the option, the associated condition is always
98 [[inst-point-type-cond]]
99 Instrumentation point type condition
100 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
101 An event{nbsp}__E__ satisfies the instrumentation point type condition
102 of an event rule if the instrumentation point from which LTTng
103 creates{nbsp}__E__ is:
105 For the Linux kernel tracing domain (option:--domain=++kernel++ option)::
106 With the option:--type=++tracepoint++ option or without any option:--type option:::
107 An LTTng kernel tracepoint, that is, a statically defined point
108 in the source code of the kernel image or of a kernel module
109 with LTTng kernel tracer macros.
111 As of LTTng{nbsp}{lttng_version}, this is the default instrumentation
112 point type of the Linux kernel tracing domain, but this may change in
115 List the available Linux kernel tracepoints with `lttng list --kernel`.
116 See man:lttng-list(1) to learn more.
118 With the option:--type=++syscall++, option:--type=++syscall:entry++, option:--type=++syscall:exit++, or option:--type=++syscall:entry+exit++ option:::
119 The entry, exit, or entry and exit of a Linux kernel system
122 List the available Linux kernel system call instrumentation points with
123 `lttng list --kernel --syscall`. See man:lttng-list(1) to learn more.
125 With the option:--type=++kprobe++ option:::
126 A Linux kprobe, that is, a single probe dynamically placed in
127 the compiled kernel code.
129 You must specify the kprobe location with the option:--location option.
131 The payload of a Linux kprobe event is empty.
133 With the option:--type=++uprobe++ option:::
134 A Linux user space probe, that is, a single probe dynamically
135 placed at the entry of a compiled user space application/library
136 function through the kernel.
138 LTTng{nbsp}{lttng_version} supports the ELF and SystemTap User-level
139 Statically Defined Tracing (USDT; a DTrace-style marker) probing
140 methods. LTTng only supports USDT probes which are :not:
143 You must specify the user space probe location with the
144 option:--location option.
146 The payload of a Linux user space probe event is empty.
148 For the user space tracing domain (option:--domain=++user++ option)::
149 With or without the option:--type=++tracepoint++ option:::
150 An LTTng user space tracepoint, that is, a statically defined point
151 in the source code of a C/$$C++$$ application/library
152 with LTTng user space tracer macros.
154 As of LTTng{nbsp}{lttng_version}, this is the default and sole
155 instrumentation point type of the user space tracing domain, but this
156 may change in the future.
158 List the available user space tracepoints with `lttng list --userspace`.
159 See man:lttng-list(1) to learn more.
161 For the `java.util.logging` (option:--domain=++jul++ option), Apache log4j (option:--domain=++log4j++ option), and Python (option:--domain=++python++ option) tracing domains::
162 With or without the option:--type=++logging++ option:::
165 As of LTTng{nbsp}{lttng_version}, this is the default and sole
166 instrumentation point type of the `java.util.logging`, Apache log4j, and
167 Python tracing domains, but this may change in the future.
169 List the available Java and Python loggers with `lttng list --jul`,
170 `lttng list --log4j`, and `lttng list --python`. See man:lttng-list(1)
177 An event{nbsp}__E__ satisfies the event name condition of an event
178 rule{nbsp}__ER__ if the two following statements are true:
180 * You don't specify the option:--name='NAME' option or, depending on the
181 instrumentation type condition (see the
182 <<inst-point-type-cond,Instrumentation point type condition>> section
183 above) of{nbsp}__ER__, 'NAME' matches:
187 The full name of the tracepoint from which LTTng creates{nbsp}__E__.
189 Note that the full name of a user space tracepoint is
190 __PROVIDER__++:++__NAME__, where __PROVIDER__ is the tracepoint provider
191 name and __NAME__ is the tracepoint name.
194 The name of the Java or Python logger from which LTTng
198 The name of the system call, without any `sys_` prefix, from which
199 LTTng creates{nbsp}__E__.
202 * You don't specify any option:--exclude-name='XNAME' option or
203 none of the 'XNAME' arguments matches the full name of the user space
204 tracepoint from which LTTng creates{nbsp}__E__.
206 The option:--exclude-name option is only available with the
207 option:--domain=++user++ option.
209 This condition is only meaningful for the LTTng tracepoint, logging
210 statement, and Linux system call instrumentation point types: it's
211 always satisfied for the other types.
213 In all cases, 'NAME' and 'XNAME' are globbing patterns: the `*`
214 character means ``match anything''. To match a literal `*` character,
217 IMPORTANT: Make sure to **single-quote** 'NAME' and 'XNAME' when they
218 contain the `*` character and when you run an man:lttng(1) command from
221 As of LTTng{nbsp}{lttng_version}, not specifying the option:--name
222 option is equivalent to specifying option:--name=++\'*\'++, but this
223 default may change in the future.
226 [[inst-point-log-level-cond]]
227 Instrumentation point log level condition
228 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
229 An event{nbsp}__E__ satisfies the instrumentation point log level
230 condition of an event rule if either:
232 * You specify the option:--log-level=++..++ option or you don't specify
233 the option:--log-level option.
235 Defaulting to option:--log-level=++..++ when you don't specify the
236 option:--log-level option is specific to LTTng{nbsp}{lttng_version} and
237 may change in the future.
239 * The log level of the LTTng user space tracepoint or logging statement
240 from which LTTng creates{nbsp}__E__ is:
241 With the option:--log-level=__LOGLEVEL__++..++ option::
242 At least as severe as 'LOGLEVEL'.
244 With the option:--log-level=__LOGLEVEL__ option::
247 As of LTTng{nbsp}{lttng_version}, the ++..++__LOGLEVEL__ and
248 __LOGLEVEL__++..++__LOGLEVEL__ formats are :not: supported.
250 This condition is only meaningful for the LTTng user space tracepoint
251 and logging statement instrumentation point types: it's always satisfied
254 The available values of 'LOGLEVEL' are, depending on the tracing domain,
255 from the most to the least severe:
257 User space (option:--domain=++user++ option)::
258 Shortcuts such as `system` are allowed.
264 * `TRACE_WARNING` (4)
267 * `TRACE_DEBUG_SYSTEM` (7)
268 * `TRACE_DEBUG_PROGRAM` (8)
269 * `TRACE_DEBUG_PROCESS` (9)
270 * `TRACE_DEBUG_MODULE` (10)
271 * `TRACE_DEBUG_UNIT` (11)
272 * `TRACE_DEBUG_FUNCTION` (12)
273 * `TRACE_DEBUG_LINE` (13)
276 `java.util.logging` (option:--domain=++jul++ option)::
277 Shortcuts such as `severe` are allowed.
279 * `JUL_OFF` (`INT32_MAX`)
280 * `JUL_SEVERE` (1000)
281 * `JUL_WARNING` (900)
287 * `JUL_ALL` (`INT32_MIN`)
289 Apache log4j (option:--domain=++log4j++ option)::
290 Shortcuts such as `severe` are allowed.
292 * `LOG4J_OFF` (`INT32_MAX`)
293 * `LOG4J_FATAL` (50000)
294 * `LOG4J_ERROR` (40000)
295 * `LOG4J_WARN` (30000)
296 * `LOG4J_INFO` (20000)
297 * `LOG4J_DEBUG` (10000)
298 * `LOG4J_TRACE` (5000)
299 * `LOG4J_ALL` (`INT32_MIN`)
301 Python (option:--domain=++python++ option)::
302 Shortcuts such as `critical` are allowed.
304 * `PYTHON_CRITICAL` (50)
305 * `PYTHON_ERROR` (40)
306 * `PYTHON_WARNING` (30)
308 * `PYTHON_DEBUG` (10)
309 * `PYTHON_NOTSET` (0)
313 Event payload and context filter condition
314 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
315 An event{nbsp}__E__ satisfies the event payload and context filter
316 condition of an event rule if the option:--filter='EXPR' option is
317 missing or if 'EXPR' is _true_.
319 This condition is only meaningful for the LTTng tracepoint and Linux
320 system call instrumentation point types: it's always satisfied for other
323 'EXPR' can contain references to the payload fields of{nbsp}__E__ and
324 to the current context fields.
326 IMPORTANT: Make sure to **single-quote** 'EXPR' when you run an
327 man:lttng(1) command from a shell, as filter expressions typically
328 include characters having a special meaning for most shells.
330 The expected syntax of 'EXPR' is similar to the syntax of a
331 C{nbsp}language conditional expression (an expression which an `if`
332 statement can evaluate), but there are a few differences:
334 * A _NAME_ expression identifies an event payload field named
335 _NAME_ (a C{nbsp}identifier).
337 Use the C{nbsp}language dot and square bracket notations to access
338 nested structure and array/sequence fields. You can only use a constant,
339 positive integer number within square brackets. If the index is out of
340 bounds, 'EXPR' is _false_.
342 The value of an enumeration field is an integer.
344 When a field expression doesn't exist, 'EXPR' is _false_.
346 Examples: `my_field`, `target_cpu`, `seq[7]`, `msg.user[1].data[2][17]`.
348 * A ++$ctx.++__TYPE__ expression identifies the statically-known context
349 field having the type _TYPE_ (a C{nbsp}identifier).
351 List the available statically-known context field names with the
352 man:lttng-add-context(1) command.
354 When a field expression doesn't exist, 'EXPR' is _false_.
356 Examples: `$ctx.prio`, `$ctx.preemptible`,
357 `$ctx.perf:cpu:stalled-cycles-frontend`.
359 * A ++$app.++__PROVIDER__++:++__TYPE__ expression identifies the
360 application-specific context field having the type _TYPE_ (a
361 C{nbsp}identifier) from the provider _PROVIDER_ (a C{nbsp}identifier).
363 When a field expression doesn't exist, 'EXPR' is _false_.
365 Example: `$app.server:cur_user`.
367 * Compare strings, either string fields or string literals
368 (double-quoted), with the `==` and `!=` operators.
370 When comparing to a string literal, the `*` character means ``match
371 anything''. To match a literal `*` character, use :escwc:.
373 Examples: `my_field == "user34"`, `my_field == my_other_field`,
374 `my_field == "192.168.*"`.
376 * The precedence table of the operators which are supported in 'EXPR'
377 is as follows. In this table, the highest precedence is{nbsp}1:
381 |Precedence |Operator |Description |Associativity
382 |1 |`-` |Unary minus |Right-to-left
383 |1 |`+` |Unary plus |Right-to-left
384 |1 |`!` |Logical NOT |Right-to-left
385 |1 |`~` |Bitwise NOT |Right-to-left
386 |2 |`<<` |Bitwise left shift |Left-to-right
387 |2 |`>>` |Bitwise right shift |Left-to-right
388 |3 |`&` |Bitwise AND |Left-to-right
389 |4 |`^` |Bitwise XOR |Left-to-right
390 |5 |`\|` |Bitwise OR |Left-to-right
391 |6 |`<` |Less than |Left-to-right
392 |6 |`<=` |Less than or equal to |Left-to-right
393 |6 |`>` |Greater than |Left-to-right
394 |6 |`>=` |Greater than or equal to |Left-to-right
395 |7 |`==` |Equal to |Left-to-right
396 |7 |`!=` |Not equal to |Left-to-right
397 |8 |`&&` |Logical AND |Left-to-right
398 |9 |`\|\|` |Logical OR |Left-to-right
401 Parentheses are supported to bypass the default order.
403 IMPORTANT: Unlike the C{nbsp}language, the bitwise AND and OR operators
404 (`&` and `|`) in 'EXPR' take precedence over relational operators (`<`,
405 `<=`, `>`, `>=`, `==`, and `!=`). This means the expression `2 & 2 == 2`
406 is _true_ while the equivalent C{nbsp}expression is _false_.
408 The arithmetic operators are :not: supported.
410 LTTng first casts all integer constants and fields to signed 64-bit
411 integers. The representation of negative integers is two's complement.
412 This means that, for example, the signed 8-bit integer field 0xff (-1)
413 becomes 0xffffffffffffffff (still -1) once casted.
415 Before a bitwise operator is applied, LTTng casts all its operands to
416 unsigned 64-bit integers, and then casts the result back to a signed
417 64-bit integer. For the bitwise NOT operator, it's the equivalent of
418 this C{nbsp}expression:
422 (int64_t) ~((uint64_t) val)
425 For the binary bitwise operators, it's the equivalent of those
430 (int64_t) ((uint64_t) lhs >> (uint64_t) rhs)
431 (int64_t) ((uint64_t) lhs << (uint64_t) rhs)
432 (int64_t) ((uint64_t) lhs & (uint64_t) rhs)
433 (int64_t) ((uint64_t) lhs ^ (uint64_t) rhs)
434 (int64_t) ((uint64_t) lhs | (uint64_t) rhs)
437 If the right-hand side of a bitwise shift operator (`<<` and `>>`) is
438 not in the [0,{nbsp}63] range, then 'EXPR' is _false_.
442 ----------------------------
443 msg_id == 23 && size >= 2048
444 ----------------------------
446 -------------------------------------------------
447 $ctx.procname == "lttng*" && (!flag || poel < 34)
448 -------------------------------------------------
450 ---------------------------------------------------------
451 $app.my_provider:my_context == 17.34e9 || some_enum >= 14
452 ---------------------------------------------------------
454 ---------------------------------------
455 $ctx.cpu_id == 2 && filename != "*.log"
456 ---------------------------------------
458 ------------------------------------------------
459 eax_reg & 0xff7 == 0x240 && x[4] >> 12 <= 0x1234
460 ------------------------------------------------
463 Migration from a recording event rule specification
464 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
465 Since LTTng{nbsp}2.13, what this manual page documents is the standard,
466 common way to specify an LTTng event rule.
468 With the man:lttng-enable-event(1) command, you also specify an event
469 rule, but with deprecated options and arguments.
471 The following table shows how to translate from the
472 man:lttng-enable-event(1) options and arguments to the common event
473 rule specification options:
477 |Recording event rule option(s)/argument(s) |Common event rule option(s)
479 |nloption:--kernel |option:--domain=++kernel++
480 |nloption:--userspace |option:--domain=++user++
481 |nloption:--jul |option:--domain=++jul++
482 |nloption:--log4j |option:--domain=++log4j++
483 |nloption:--python |option:--domain=++python++
484 |nloption:--tracepoint (with nloption:--kernel/nloption:--userspace) |option:--type=++tracepoint++ or no option:--type option
485 |nloption:--tracepoint (with nloption:--jul/nloption:--log4j/nloption:--python) |option:--type=++logging++ or no option:--type option
486 |nloption:--syscall |option:--type=++syscall++ or option:--type=++syscall:entry+exit++
487 |nloption:--probe='LOC' and 'RECORDNAME' (non-option) |option:--type=++kprobe++, option:--location='LOC', and option:--event-name='RECORDNAME'
488 |nloption:--userspace-probe='LOC' and 'RECORDNAME' (non-option) |option:--type=++uprobe++, option:--location='LOC', and option:--event-name='RECORDNAME'
489 |nloption:--function='LOC' and 'RECORDNAME' (non-option) |Not available as of LTTng{nbsp}{lttng_version}
490 |'NAME' (non-option) |option:--name='NAME'
491 |nloption:--all |option:--name=++\'*\'++ or no option:--name option
492 |nloption:--exclude=__XNAME__[++,++__XNAME__]... |option:--exclude-name='XNAME' for each 'XNAME'
493 |nloption:--loglevel='LOGLEVEL' |option:--log-level=__LOGLEVEL__++..++
494 |nloption:--loglevel-only='LOGLEVEL' |option:--log-level=__LOGLEVEL__
495 |nloption:--filter='EXPR' |option:--filter='EXPR'
503 option:-d 'DOMAIN', option:--domain='DOMAIN'::
504 Only match events which LTTng creates in the tracing domain
523 This option is mandatory.
526 Instrumentation point type condition
527 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
528 See the <<inst-point-type-cond,Instrumentation point type condition>>
531 option:-E 'NAME', option:--event-name='NAME'::
532 With the option:--type=++kprobe++ or option:--type=++uprobe++
533 option, set the name of the emitted events to 'NAME' instead of the
534 'LOC' argument of the option:--location='LOC' option.
536 Defaulting to 'LOC' is specific to LTTng{nbsp}{lttng_version} and may
537 change in the future.
539 option:-L 'LOC', option:--location='LOC'::
540 With the option:--type=++kprobe++ option:::
541 Set the location of the Linux kprobe to insert to 'LOC'.
545 * An address (`0x` hexadecimal prefix supported).
547 * A symbol name and an offset (__SYMBOL__++pass:[+]++__OFFSET__ format).
549 With the option:--type=++uprobe++ option:::
550 Set the location of the user space probe to insert to 'LOC'.
554 \[++elf:++]__PATH__++:++__SYMBOL__::::
555 An available symbol within a user space application or library.
559 Application or library path.
565 * The name of an application as found in the directories listed in the
566 `PATH` environment variable.
569 Symbol name of the function of which to instrument the entry.
571 'SYMBOL' can be any defined code symbol in the output of the man:nm(1)
572 command, including with its nloption:--dynamic option, which lists
576 As of LTTng{nbsp}{lttng_version}, not specifying `elf:` is equivalent to
577 specifying it, but this default may change in the future.
581 * `/usr/lib/libc.so.6:malloc`
582 * `./myapp:createUser`
583 * `elf:httpd:ap_run_open_htaccess`
585 ++sdt:++__PATH__++:++__PROVIDER__++:++__NAME__::::
586 A SystemTap User-level Statically Defined Tracing (USDT) probe
587 within a user space application or library.
591 Application or library path.
597 * The name of an application as found in the directories listed in the
598 `PATH` environment variable.
602 USDT provider and probe names.
604 For example, with the following USDT probe:
608 DTRACE_PROBE2("server", "accept_request",
609 request_id, ip_addr);
612 The provider/probe name pair is `server:accept_request`.
615 Example: `sdt:./build/server:server:accept_request`
617 option:-t 'TYPE', option:--type='TYPE'::
618 Only match events which LTTng creates from an instrumentation point
619 having the type 'TYPE'.
627 Only available with the option:--domain=++kernel++ and
628 option:--domain=++user++ options.
630 As of LTTng{nbsp}{lttng_version}, this is the default instrumentation
631 point type of the Linux kernel and user space tracing domains, but this
632 may change in the future.
637 Only available with the option:--domain=++jul++,
638 option:--domain=++log4j++, and option:--domain=++python++ options.
640 As of LTTng{nbsp}{lttng_version}, this is the default instrumentation
641 point type of the `java.util.logging`, Apache log4j, and Python tracing
642 domains, but this may change in the future.
645 As of LTTng{nbsp}{lttng_version}, equivalent to
646 `syscall:entry+exit`, but this default may change in the future.
648 Only available with the option:--domain=++kernel++ option.
651 Linux system call entry.
653 Only available with the option:--domain=++kernel++ option.
656 Linux system call exit.
658 Only available with the option:--domain=++kernel++ option.
660 `syscall:entry+exit`::
661 Linux system call entry and exit (two distinct instrumentation
664 Only available with the option:--domain=++kernel++ option.
669 Only available with the option:--domain=++kernel++ option.
671 You must specify the location of the kprobe to insert with the
672 option:--location option.
674 You may specify the name of the emitted events with the
675 option:--event-name option.
677 `uprobe` or `userspace-probe`::
678 Linux user space probe.
680 Only available with the option:--domain=++kernel++ option.
682 You must specify the location of the user space probe to insert with the
683 option:--location option.
685 You may specify the name of the emitted events with the
686 option:--event-name option.
692 See the <<event-name-cond,Event name condition>> section above.
694 option:-n 'NAME', option:--name='NAME'::
695 Only match events of which 'NAME' matches:
698 With the option:--domain=++kernel++ or option:--domain=++user++ option, with the option:--type=++tracepoint++ option or without the option:--type option:::
699 The full name of the LTTng tracepoint.
701 With the option:--domain=++jul++, option:--domain=++log4j++, or option:--domain=++python++ option:::
702 The Java or Python logger name.
704 With the option:--domain=++kernel++ option and one of the option:--type=++syscall++, option:--type=++syscall:entry++, option:--type=++syscall:exit++, and option:--type=++syscall:entry+exit++ options:::
705 The name of the system call, without any `sys_` prefix.
708 This option is :not: available with the option:--type=++kprobe++ and
709 option:--type=++uprobe++ options.
711 As of LTTng{nbsp}{lttng_version}, not specifying this option is
712 equivalent to specifying option:--name=++\'*\'++ (when it applies), but
713 this default may change in the future.
715 option:-x 'XNAME', option:--exclude='XNAME'::
716 Only match events of which 'XNAME' does :not: match the full name of
717 the LTTng user space tracepoint.
719 Only available with the option:--domain=++user++ option.
721 'NAME' and 'XNAME' are globbing patterns: the `*` character means
722 ``match anything''. To match a literal `*` character, use :escwc:.
725 Instrumentation point log level condition
726 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
727 See the <<inst-point-log-level-cond,Instrumentation point log level
728 condition>> section above.
730 option:-l 'LOGLEVELSPEC', option:--log-level='LOGLEVELSPEC'::
731 Only match events of which the log level of the LTTng tracepoint or
732 logging statement is, depending on the format of 'LOGLEVELSPEC':
736 At least as severe as 'LOGLEVEL'.
745 This option is :not: available with the option:--domain=++kernel++
748 As of LTTng{nbsp}{lttng_version}, not specifying this option is
749 equivalent to specifying option:--log-level=++..++ (when it applies),
750 but this default may change in the future.
753 Event payload and context filter condition
754 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
755 See the <<filter-cond,Event payload and context filter condition>>
758 option:-f 'EXPR', option:--filter='EXPR'::
759 Only match events of which 'EXPR', which can contain references to
760 event payload and current context fields, is _true_.
762 This option is only available with the following options:
764 * option:--type=++tracepoint++
765 * option:--type=++syscall++
766 * option:--type=++syscall:entry++
767 * option:--type=++syscall:exit++
768 * option:--type=++syscall:entry+exit++
771 include::common-footer.txt[]
777 man:lttng-add-trigger(1),
779 man:lttng-concepts(7)