+[[filter-cond]]
+Event payload and context filter condition
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+An event{nbsp}__E__ satisfies the event payload and context filter
+condition of a recording event rule if the option:--filter='EXPR'
+option is missing or if 'EXPR' is _true_.
+
+'EXPR' can contain references to the payload fields of{nbsp}__E__ and
+to the current context fields.
+
+IMPORTANT: Make sure to **single-quote** 'EXPR' when you run the
+`enable-event` command from a shell, as filter expressions typically
+include characters having a special meaning for most shells.
+
+The expected syntax of 'EXPR' is similar to the syntax of a
+C{nbsp}language conditional expression (an expression which an `if`
+statement can evaluate), but there are a few differences:
+
+* A _NAME_ expression identifies an event payload field named
+ _NAME_ (a C{nbsp}identifier).
++
+Use the C{nbsp}language dot and square bracket notations to access
+nested structure and array/sequence fields. You can only use a constant,
+positive integer number within square brackets. If the index is out of
+bounds, 'EXPR' is _false_.
++
+The value of an enumeration field is an integer.
++
+When a field expression doesn't exist, 'EXPR' is _false_.
++
+Examples: `my_field`, `target_cpu`, `seq[7]`, `msg.user[1].data[2][17]`.
+
+* A ++$ctx.++__TYPE__ expression identifies the statically-known context
+ field having the type _TYPE_ (a C{nbsp}identifier).
++
+List the available statically-known context field names with the
+man:lttng-add-context(1) command.
++
+When a field expression doesn't exist, 'EXPR' is _false_.
++
+Examples: `$ctx.prio`, `$ctx.preemptible`,
+`$ctx.perf:cpu:stalled-cycles-frontend`.
+
+* A ++$app.++__PROVIDER__++:++__TYPE__ expression identifies the
+ application-specific context field having the type _TYPE_ (a
+ C{nbsp}identifier) from the provider _PROVIDER_ (a C{nbsp}identifier).
++
+When a field expression doesn't exist, 'EXPR' is _false_.
++
+Example: `$app.server:cur_user`.
+
+* Compare strings, either string fields or string literals
+ (double-quoted), with the `==` and `!=` operators.
++
+When comparing to a string literal, the `*` character means ``match
+anything''. To match a literal `*` character, use :escwc:.
++
+Examples: `my_field == "user34"`, `my_field == my_other_field`,
+`my_field == "192.168.*"`.
+
+* The precedence table of the operators which are supported in 'EXPR'
+ is as follows. In this table, the highest precedence is{nbsp}1:
++
+[options="header"]
+|===
+|Precedence |Operator |Description |Associativity
+|1 |`-` |Unary minus |Right-to-left
+|1 |`+` |Unary plus |Right-to-left
+|1 |`!` |Logical NOT |Right-to-left
+|1 |`~` |Bitwise NOT |Right-to-left
+|2 |`<<` |Bitwise left shift |Left-to-right
+|2 |`>>` |Bitwise right shift |Left-to-right
+|3 |`&` |Bitwise AND |Left-to-right
+|4 |`^` |Bitwise XOR |Left-to-right
+|5 |`\|` |Bitwise OR |Left-to-right
+|6 |`<` |Less than |Left-to-right
+|6 |`<=` |Less than or equal to |Left-to-right
+|6 |`>` |Greater than |Left-to-right
+|6 |`>=` |Greater than or equal to |Left-to-right
+|7 |`==` |Equal to |Left-to-right
+|7 |`!=` |Not equal to |Left-to-right
+|8 |`&&` |Logical AND |Left-to-right
+|9 |`\|\|` |Logical OR |Left-to-right
+|===
++
+Parentheses are supported to bypass the default order.
++
+IMPORTANT: Unlike the C{nbsp}language, the bitwise AND and OR operators
+(`&` and `|`) in 'EXPR' take precedence over relational operators (`<`,
+`<=`, `>`, `>=`, `==`, and `!=`). This means the expression `2 & 2 == 2`
+is _true_ while the equivalent C{nbsp}expression is _false_.
++
+The arithmetic operators are :not: supported.
++
+LTTng first casts all integer constants and fields to signed 64-bit
+integers. The representation of negative integers is two's complement.
+This means that, for example, the signed 8-bit integer field 0xff (-1)
+becomes 0xffffffffffffffff (still -1) once casted.
++
+Before a bitwise operator is applied, LTTng casts all its operands to
+unsigned 64-bit integers, and then casts the result back to a signed
+64-bit integer. For the bitwise NOT operator, it's the equivalent of
+this C{nbsp}expression:
++
+[source,c]
+----
+(int64_t) ~((uint64_t) val)
+----
++
+For the binary bitwise operators, it's the equivalent of those
+C{nbsp}expressions:
++
+[source,c]
+----
+(int64_t) ((uint64_t) lhs >> (uint64_t) rhs)
+(int64_t) ((uint64_t) lhs << (uint64_t) rhs)
+(int64_t) ((uint64_t) lhs & (uint64_t) rhs)
+(int64_t) ((uint64_t) lhs ^ (uint64_t) rhs)
+(int64_t) ((uint64_t) lhs | (uint64_t) rhs)
+----
++
+If the right-hand side of a bitwise shift operator (`<<` and `>>`) is
+not in the [0,{nbsp}63] range, then 'EXPR' is _false_.
+
+[NOTE]
+====
+Use the man:lttng-track(1) and man:lttng-untrack(1) commands to allow or
+disallow processes to record LTTng events based on their attributes
+instead of using equivalent statically-known context fields in 'EXPR'
+like `$ctx.pid`.
+
+The former method is much more efficient.
+====
+
+'EXPR' examples:
+
+----------------------------
+msg_id == 23 && size >= 2048
+----------------------------
+
+-------------------------------------------------
+$ctx.procname == "lttng*" && (!flag || poel < 34)
+-------------------------------------------------
+
+---------------------------------------------------------
+$app.my_provider:my_context == 17.34e9 || some_enum >= 14
+---------------------------------------------------------
+
+---------------------------------------
+$ctx.cpu_id == 2 && filename != "*.log"
+---------------------------------------
+
+------------------------------------------------
+eax_reg & 0xff7 == 0x240 && x[4] >> 12 <= 0x1234
+------------------------------------------------
+
+
+[[er-name]]
+Event record name
+~~~~~~~~~~~~~~~~~
+When LTTng records an event{nbsp}__E__, the resulting event record has a
+name which depends on the instrumentation point type condition (see the
+<<inst-point-type-cond,Instrumentation point type condition>> section)
+of the recording event rule which matched{nbsp}__E__:
+
+LTTng tracepoint (option:--kernel/option:--userspace and option:--tracepoint options)::
+ Full name of the tracepoint from which LTTng creates{nbsp}__E__.
++
+Note that the full name of a user space tracepoint is
+__PROVIDER__++:++__NAME__, where __PROVIDER__ is the tracepoint provider
+name and __NAME__ is the tracepoint name.
+
+`java.util.logging` logging statement (option:--jul and option:--tracepoint options)::
+ `lttng_jul:event`
++
+Such an event record has a string field `logger_name` which contains the
+name of the `java.util.logging` logger from which LTTng
+creates{nbsp}__E__.
+
+Apache log4j logging statement (option:--log4j and option:--tracepoint options)::
+ `lttng_log4j:event`
++
+Such an event record has a string field `logger_name` which contains the
+name of the Apache log4j logger from which LTTng creates{nbsp}__E__.
+
+Python logging statement (option:--python and option:--tracepoint options)::
+ `lttng_python:event`
++
+Such an event record has a string field `logger_name` which contains the
+name of the Python logger from which LTTng creates{nbsp}__E__.
+
+Linux system call (option:--kernel and option:--syscall options)::
+ Entry:::
+ ++syscall_entry_++__NAME__, where _NAME_ is the name of the
+ system call from which LTTng creates{nbsp}__E__, without any
+ `sys_` prefix.
+
+ Exit:::
+ ++syscall_exit_++__NAME__, where _NAME_ is the name of the
+ system call from which LTTng creates{nbsp}__E__, without any
+ `sys_` prefix.
+
+Linux kprobe (option:--kernel and option:--probe options)::
+Linux user space probe (option:--kernel and option:--userspace-probe options)::
+ 'RECORDNAME' (first non-option argument).
+
+Linux kretprobe (option:--kernel and option:--function options)::
+ Entry:::
+ __RECORDNAME__++_entry++
+
+ Exit:::
+ __RECORDNAME__++_exit++
+
+
+[[enable]]
+Enable a disabled recording event rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+The `enable-event` command can enable an existing, disabled recording
+event rule, as listed in the output of the man:lttng-list(1) command.
+
+You may enable a disabled recording event rule regardless of the
+activity (started or stopped) of its tracing session (see
+man:lttng-start(1) and man:lttng-stop(1)).
+
+To enable a disabled recording event rule, run the `enable-event`
+command with the exact same options and arguments that you used to
+create it. In particular, with the option:--filter='EXPR' option, 'EXPR'
+must be the exact same string as the one you used on creation.
+
+