[LTTng学习之旅]------core concepts 拾遗

文档总是看了又忘，写点什么，也就算是为了忘却的纪念。。

核心概念

From a user’s perspective, the LTTng system is built on a few concepts, or objects, on which the lttng command-line tool operates by sending commands to the session daemon (through liblttng-ctl).

Understanding how those objects relate to each other is key to master the toolkit.
The core concepts of LTTng are:

• Instrumentation point, event rule, and event
• Trigger
• Recording session
• Tracing domain
• Channel and ring buffer
• Recording event rule and event record

Instrumentation point, event rule, and event

An instrumentation point is a point, within a piece of software, which, when executed, creates an LTTng event.
An event rule is a set of conditions to match a set of events.
When LTTng creates an event E, an event rule ER is said to match E when E satisfies all the conditions of ER. This concept is similar to a regular expression which matches a set of strings.
When an event rule matches an event, LTTng emits the event, therefore attempting to execute one or more actions.
The event creation and emission processes are documentation concepts to help understand the journey from an instrumentation point to the execution of actions.
As of LTTng 2.13, there are two places where you can find an event rule:

• Recording event rule
  A specific type of event rule of which the action is to record the matched event as an event record.
  执行操作是记录捕获event为event record 的 event。
• “Event rule matches” trigger condition (since LTTng 2.13)
  When the event rule of the trigger condition matches an event, LTTng can execute user-defined actions such as sending an LTTng notification, starting a recording session, and more.
  触发条件满足，就执行用户设定的行为。

Instrumentation point types

As of LTTng 2.13, the available instrumentation point types are, depending on the tracing domain:

Linux kernel

• LTTng tracepoint
  A statically defined point in the source code of the kernel image or of a kernel module using the LTTng-modules macros.
  内核中的静态追踪点或者使用LTTng宏的内核模块。
• Linux kernel system call
  Entry, exit, or both of a Linux kernel system call.
• Linux kprobe
  A single probe dynamically placed in the compiled kernel code.
  When you create such an instrumentation point, you set its memory address or symbol name.
  这个是所谓的动态Trace了，可以窥见要设置地址和符号名
• Linux user space probe
  A single probe dynamically placed at the entry of a compiled user space application/library function through the kernel.
  动态的把探针放在编译好的用户应用或者库的该函数里。
  When you create such an instrumentation point, you set:
  • With the ELF method
    Its application/library path and its symbol name.
  • With the USDT method
    Its application/library path, its provider name, and its probe name.
    “USDT” stands for SystemTap User-level Statically Defined Tracing, a DTrace-style marker.
• Linux kretprobe
  Entry, exit, or both of a Linux kernel function.
  When you create such an instrumentation point, you set the memory address or symbol name of its function.

User space

• LTTng tracepoint

A statically defined point in the source code of a C/C++ application/library using the LTTng-UST macros.

• java.util.logging, Apache log4j, and Python Java or Python logging
  statement

A method call on a Java or Python logger attached to an LTTng-UST handler.

Trigger

A trigger associates a condition to one or more actions.

When the condition of a trigger is satisfied, LTTng attempts to execute its actions.

Conditions
The consumed buffer size of a given recording session becomes greater than some value.

The buffer usage of a given channel becomes greater than some value.

The buffer usage of a given channel becomes less than some value.
buffer 相关
There’s an ongoing recording session rotation.

A recording session rotation becomes completed.
会话相关
An event rule matches an event.
ER 满足

Actions
Send a notification to a user application.
通知别的APP
Start a given recording session.

Stop a given recording session.
启停记录会话
Archive the current trace chunk of a given recording session (rotate).

Take a snapshot of a given recording session.
数据归档相关

A trigger belongs to a session daemon, not to a specific recording session. For a given session daemon, each Unix user has its own, private triggers. Note, however, that the root Unix user may, for the root session daemon:

Add a trigger as another Unix user.

List all the triggers, regardless of their owner.

Remove a trigger which belongs to another Unix user.

For a given session daemon and Unix user, a trigger has a unique name.
触发器是封装给每个用户了，root可以管理所有的

Recording session

A recording session (named “tracing session” prior to LTTng 2.13) is a stateful dialogue between you and a session daemon for everything related to event recording.
我和session daemon之间 的会话。用于控制事件记录
Everything that you do when you control LTTng tracers to record events happens within a recording session.

In particular, a recording session:

Has its own name, unique for a given session daemon.

Has its own set of trace files, if any.

Has its own state of activity (started or stopped).
An active recording session is an implicit recording event rule condition.

Has its own mode (local, network streaming, snapshot, or live).

Has its own channels to which are attached their own recording event rules.

Has its own process attribute inclusion sets.

A recording session contains channels that are members of tracing domains and contain recording event rules.
Those attributes and objects are completely isolated between different recording sessions.
A recording session is like an ATM session: the operations you do on the banking system through the ATM don’t alter the data of other users of the same system. In the case of the ATM, a session lasts as long as your bank card is inside. In the case of LTTng, a recording session lasts from the lttng-create(1) command to the lttng-destroy(1) command.
A recording session belongs to a session daemon. For a given session daemon, each Unix user has its own, private recording sessions. Note, however, that the root Unix user may operate on or destroy another user’s recording session.

Recording session mode

Local mode
Write the trace data to the local file system.

Network streaming mode
Send the trace data over the network to a listening relay daemon.
可以远程监控是让我关注的地方

Snapshot mode
Only write the trace data to the local file system or send it to a listening relay daemon when LTTng takes a snapshot.只有需要的时候记录快照
LTTng forces all the channels to be created to be configured to be snapshot-ready.
LTTng takes a snapshot of such a recording session when:
You run the lttng-snapshot(1) command.
LTTng executes a snapshot-session trigger action.

Live mode
Send the trace data over the network to a listening relay daemon for live reading.
在线读取？
An LTTng live reader (for example, babeltrace2(1)) can connect to the same relay daemon to receive trace data while the recording session is active.

Tracing domain

A tracing domain identifies a type of LTTng tracer.

A tracing domain has its own properties and features.

There are currently five available tracing domains:

Linux kernel

User space

java.util.logging (JUL)

log4j

Python

You must specify a tracing domain to target a type of LTTng tracer when using some lttng commands to avoid ambiguity. For example, because the Linux kernel and user space tracing domains support named tracepoints as instrumentation points, you need to specify a tracing domain when you create an event rule because both tracing domains could have tracepoints sharing the same name.
就是用来指明追踪的是内核还是用户程序，指明追踪的种类，这个没什么。
You can create channels in the Linux kernel and user space tracing domains. The other tracing domains have a single, default channel.
注意是在domain里建立 channel 哦

Channel and ring buffer

这一节讲的数据结构。以及对效率、trace数据丢失等方面的策略。
等用到了再回来看吧。