contents/getting-started/tracing-the-linux-kernel.md

   1 ---
   2 id: tracing-the-linux-kernel
   3 ---
   4
   5 Make sure LTTng-tools and LTTng-modules packages
   6 [are installed](#doc-installing-lttng).
   7
   8 Since you're about to trace the Linux kernel itself, let's look at the
   9 available kernel events using the `lttng` tool, which has a
  10 Git-like command line structure:
  11
  12 <pre class="term">
  13 lttng list --kernel
  14 </pre>
  15
  16 Before tracing, you need to create a session:
  17
  18 <pre class="term">
  19 sudo lttng create
  20 </pre>
  21
  22 <div class="tip">
  23 <p>
  24     <span class="t">Tip:</span>You can avoid using <code>sudo</code> in
  25     the previous and following commands if your user is a member of the
  26     <a href="#doc-lttng-sessiond" class="int"><code>tracing</code>
  27     group</a>.
  28 </p>
  29 </div>
  30
  31 Let's now enable some events for this session:
  32
  33 <pre class="term">
  34 sudo lttng enable-event --kernel sched_switch,sched_process_fork
  35 </pre>
  36
  37 Or you might want to simply enable all available kernel events (beware
  38 that trace files grow rapidly when doing this):
  39
  40 <pre class="term">
  41 sudo lttng enable-event --kernel --all
  42 </pre>
  43
  44 Start tracing:
  45
  46 <pre class="term">
  47 sudo lttng start
  48 </pre>
  49
  50 By default, traces are saved in
  51 <code>~/lttng-traces/<em>name</em>-<em>date</em>-<em>time</em></code>,
  52 where <code><em>name</em></code> is the session name.
  53
  54 When you're done tracing:
  55
  56 <pre class="term">
  57 sudo lttng stop
  58 sudo lttng destroy
  59 </pre>
  60
  61 Although `destroy` looks scary here, it doesn't actually destroy the
  62 written trace files: it only destroys the tracing session.
  63
  64 What's next? Have a look at
  65 [Viewing and analyzing your traces](#doc-viewing-and-analyzing-your-traces)
  66 to view and analyze the trace you just recorded.