Linux Tools Project/LTTngLegacy/User Guide

Introduction

LTTng (Linux Tracing Toolkit, next generation) is a highly efficient tracing tool for Linux that can be used to track down performance issues and debug problems involving multiple concurrent processes and threads. It consists of a set of kernel patches and a daemon, to collect the raw tracing data, as well as a set of tools to control, visualize and analyze the generated data.

The LTTng plug-in for Eclipse aims at replacing LTTv (LTTng visualizer), the component used to control, fetch, analyze and visualize traces produced by the LTTng tracer. A present, the LTTng Eclipse plug-in for Eclipse supports the following analyses: Control Flow, Resources and Statistics.

For more information about LTTng, refer to the project site

About Tracing

Tracing is a technique used to understand what is going on in a system in order to debug or monitor it. A tracer is the software used for tracing. Tracing can be used to debug a wide range of bugs that are otherwise extremely challenging. These include, for example, performance problems in complex parallel systems or real-time systems.

Tracing is similar to logging: it consists in recording events that happen in a system. However, compared to logging, it usually records much lower-level events that occur much more frequently. Tracers must therefore be optimized to handle a lot of data while having a small impact on the system. Tracers typically generate thousands of events per second. They generated trace frequently can easily contain millions of events and have sizes from many megabytes to tens of gigabytes.

Traces may include events from the operating system kernel (IRQ handler entry/exit, system call entry/exit, scheduling activity, network activity, etc). It can also consists of application events (a.k.a UST - User Space Tracing) or a mix of the two.

For the maximum level of detail, a tracing events may be viewed like a log file. However, trace analyzers and viewers are available to produce useful information from the raw data. These programs must be specially designed to handle quickly the enormous amount of data traces contain.

In the case of LTTng, low tracing overhead is achieved by instrumenting the Linux kernel with a set of custom patches. The same set of patches can be used for both Linux kernel as well as UST.

Traces and Experiments

In the scope of the LTTng plug-in for Eclipse, a trace is essentially a (very) large set of time-ordered LTTng events. The LTTng application can read these traces and provide a number of standard views to analyze their contents.

An experiment consists in an arbitrary number of aggregated LTTng traces for purpose of correlation. In the degenerate case, an experiment can consist of a single trace.

The experiment provides a unified, time-ordered stream of the individual LTTng trace events.