lttng-event-rule(7)

1LTTNG-EVENT-RULE(7)              LTTng Manual              LTTNG-EVENT-RULE(7)
2
3
4

NAME

6       lttng-event-rule - Common LTTng event rule specification
7

SYNOPSIS

9       Specify an event rule to match Linux kernel tracepoint or system call
10       events:
11
12       --type=(kernel:tracepoint | kernel:syscall[:entry|:exit|:entry+exit])]
13       [--name=NAME] [--filter=EXPR]
14
15       Specify an event rule to match Linux kernel kprobe or user space probe
16       events:
17
18       --type=(kernel:kprobe | kernel:uprobe) --location=LOC
19       [--event-name=EVENTNAME]
20
21       Specify an event rule to match user space tracepoint events:
22
23       --type=user:tracepoint [--name=NAME] [--exclude-name=XNAME]...
24       [--log-level=(LOGLEVEL | LOGLEVEL.. | ..)] [--filter=EXPR]
25
26       Specify an event rule to match Java/Python logging events:
27
28       --type=(jul | log4j | python):logging [--name=NAME]
29       [--log-level=(LOGLEVEL | LOGLEVEL.. | ..)] [--filter=EXPR]
30

DESCRIPTION

32       This manual page shows how to specify an LTTng event rule on the
33       command line.
34
35       As of LTTng 2.13.7, the command-line options documented here only apply
36       to the event-rule-matches trigger condition specifier (see lttng-add-
37       trigger(1)).
38
39       See lttng-concepts(7) to learn more about instrumentation points,
40       events, and event rules.
41
42       Note
43           This manual page only describes the common event rule options. The
44           lttng(1) commands which require an event rule specification may
45           accept or require other options and arguments, depending on the
46           context.
47
48           For example, the lttng-add-trigger(1) command also accepts
49           --capture options with the event-rule-matches trigger condition.
50
51   Overview of event rule condtions
52       For LTTng to emit an event E, E must satisfy all the conditions of an
53       event rule, that is:
54
55       •   The instrumentation point from which LTTng creates E has a specific
56           type.
57
58           See the “Instrumentation point type condition” section below.
59
60       •   A pattern matches the name of E while another pattern doesn’t.
61
62           See the “Event name condition” section below.
63
64       •   The log level of the instrumentation point from which LTTng
65           creates E is at least as severe as some value, or is exactly some
66           value.
67
68           See the “Instrumentation point log level condition” section below.
69
70       •   The fields of the payload of E and the current context fields
71           satisfy a filter expression.
72
73           See the “Event payload and context filter condition” section below.
74
75       The dedicated command-line options of most conditions are optional: if
76       you don’t specify the option, the associated condition is always
77       satisfied.
78
79   Instrumentation point type condition
80       An event E satisfies the instrumentation point type condition of an
81       event rule if the instrumentation point from which LTTng creates E is,
82       depending on the argument of the --type option:
83
84       kernel:tracepoint
85           An LTTng kernel tracepoint, that is, a statically defined point in
86           the source code of the kernel image or of a kernel module with
87           LTTng kernel tracer macros.
88
89           List the available Linux kernel tracepoints with lttng list
90           --kernel. See lttng-list(1) to learn more.
91
92       kernel:syscall:entry, kernel:syscall:exit, kernel:syscall:entry+exit
93           The entry, exit, or entry and exit of a Linux kernel system call.
94
95           List the available Linux kernel system call instrumentation points
96           with lttng list --kernel --syscall. See lttng-list(1) to learn
97           more.
98
99       kernel:kprobe
100           A Linux kprobe, that is, a single probe dynamically placed in the
101           compiled kernel code.
102
103           You must specify the kprobe location with the --location option.
104
105           The payload of a Linux kprobe event is empty.
106
107       kernel:uprobe
108           A Linux user space probe, that is, a single probe dynamically
109           placed at the entry of a compiled user space application/library
110           function through the kernel.
111
112           LTTng 2.13.7 supports the ELF and SystemTap User-level Statically
113           Defined Tracing (USDT; a DTrace-style marker) probing methods.
114           LTTng only supports USDT probes which are NOT reference-counted.
115
116           You must specify the user space probe location with the --location
117           option.
118
119           The payload of a Linux user space probe event is empty.
120
121       user:tracepoint
122           An LTTng user space tracepoint, that is, a statically defined point
123           in the source code of a C/C++ application/library with LTTng user
124           space tracer macros.
125
126           List the available user space tracepoints with lttng list
127           --userspace. See lttng-list(1) to learn more.
128
129       jul:logging
130           A java.util.logging logging statement.
131
132           List the available java.util.logging loggers with lttng list --jul
133           See lttng-list(1) to learn more.
134
135       log4j:logging
136           An Apache log4j logging statement.
137
138           List the available Apache log4j loggers with lttng list --log4j See
139           lttng-list(1) to learn more.
140
141       python:logging
142           A Python logging statement.
143
144           List the available Python loggers with lttng list --python See
145           lttng-list(1) to learn more.
146
147   Event name condition
148       An event E satisfies the event name condition of an event rule ER if
149       the two following statements are true:
150
151       •   You don’t specify the --name=NAME option or, depending on the
152           instrumentation type condition (see the “Instrumentation point type
153           condition” section above) of ER, NAME matches:
154
155           kernel:tracepoint, user:tracepoint
156               The full name of the tracepoint from which LTTng creates E.
157
158               Note that the full name of a user space tracepoint is
159               PROVIDER:NAME, where PROVIDER is the tracepoint provider name
160               and NAME is the tracepoint name.
161
162           jul:logging, log4j:logging, python:logging
163               The name of the Java or Python logger from which LTTng
164               creates E.
165
166           kernel:syscall:entry, kernel:syscall:exit,
167           kernel:syscall:entry+exit
168               The name of the system call, without any sys_ prefix, from
169               which LTTng creates E.
170
171       •   You don’t specify any --exclude-name=XNAME option or none of the
172           XNAME arguments matches the full name of the user space tracepoint
173           from which LTTng creates E.
174
175           The --exclude-name option is only available with the
176           --type=user:tracepoint option.
177
178       This condition is only meaningful for the LTTng tracepoint, logging
179       statement, and Linux system call instrumentation point types: it’s
180       always satisfied for the other types.
181
182       In all cases, NAME and XNAME are globbing patterns: the * character
183       means “match anything”. To match a literal * character, use \*.
184
185       Important
186           Make sure to single-quote NAME and XNAME when they contain the *
187           character and when you run an lttng(1) command from a shell.
188
189       As of LTTng 2.13.7, not specifying the --name option is equivalent to
190       specifying --name='*´, but this default may change in the future.
191
192   Instrumentation point log level condition
193       An event E satisfies the instrumentation point log level condition of
194       an event rule if either:
195
196       •   You specify the --log-level=..  option or you don’t specify the
197           --log-level option.
198
199           Defaulting to --log-level=..  when you don’t specify the --log-
200           level option is specific to LTTng 2.13.7 and may change in the
201           future.
202
203       •   The log level of the LTTng user space tracepoint or logging
204           statement from which LTTng creates E is:
205
206           With the --log-level=LOGLEVEL.. option
207               At least as severe as LOGLEVEL.
208
209           With the --log-level=LOGLEVEL option
210               Exactly LOGLEVEL.
211
212       As of LTTng 2.13.7, the ..LOGLEVEL and LOGLEVEL..LOGLEVEL formats are
213       NOT supported.
214
215       This condition is only meaningful for the LTTng user space tracepoint
216       and logging statement instrumentation point types: it’s always
217       satisfied for other types.
218
219       The available values of LOGLEVEL are, depending on the argument of the
220       --type option, from the most to the least severe:
221
222       user:tracepoint
223
224           •   EMERG (0)
225
226           •   ALERT (1)
227
228           •   CRIT (2)
229
230           •   ERR (3)
231
232           •   WARNING (4)
233
234           •   NOTICE (5)
235
236           •   INFO (6)
237
238           •   DEBUG_SYSTEM (7)
239
240           •   DEBUG_PROGRAM (8)
241
242           •   DEBUG_PROCESS (9)
243
244           •   DEBUG_MODULE (10)
245
246           •   DEBUG_UNIT (11)
247
248           •   DEBUG_FUNCTION (12)
249
250           •   DEBUG_LINE (13)
251
252           •   DEBUG (14)
253
254       jul:logging
255
256           •   OFF (INT32_MAX)
257
258           •   SEVERE (1000)
259
260           •   WARNING (900)
261
262           •   INFO (800)
263
264           •   CONFIG (700)
265
266           •   FINE (500)
267
268           •   FINER (400)
269
270           •   FINEST (300)
271
272           •   ALL (INT32_MIN)
273
274       log4j:logging
275
276           •   OFF (INT32_MAX)
277
278           •   FATAL (50000)
279
280           •   ERROR (40000)
281
282           •   WARN (30000)
283
284           •   INFO (20000)
285
286           •   DEBUG (10000)
287
288           •   TRACE (5000)
289
290           •   ALL (INT32_MIN)
291
292       python:logging
293
294           •   CRITICAL (50)
295
296           •   ERROR (40)
297
298           •   WARNING (30)
299
300           •   INFO (20)
301
302           •   DEBUG (10)
303
304           •   NOTSET (0)
305
306   Event payload and context filter condition
307       An event E satisfies the event payload and context filter condition of
308       an event rule if the --filter=EXPR option is missing or if EXPR is
309       true.
310
311       This condition is only meaningful for the LTTng tracepoint and Linux
312       system call instrumentation point types: it’s always satisfied for
313       other types.
314
315       EXPR can contain references to the payload fields of E and to the
316       current context fields.
317
318       Important
319           Make sure to single-quote EXPR when you run an lttng(1) command
320           from a shell, as filter expressions typically include characters
321           having a special meaning for most shells.
322
323       The expected syntax of EXPR is similar to the syntax of a C language
324       conditional expression (an expression which an if statement can
325       evaluate), but there are a few differences:
326
327       •   A NAME expression identifies an event payload field named NAME (a
328           C identifier).
329
330           Use the C language dot and square bracket notations to access
331           nested structure and array/sequence fields. You can only use a
332           constant, positive integer number within square brackets. If the
333           index is out of bounds, EXPR is false.
334
335           The value of an enumeration field is an integer.
336
337           When a field expression doesn’t exist, EXPR is false.
338
339           Examples: my_field, target_cpu, seq[7], msg.user[1].data[2][17].
340
341       •   A $ctx.TYPE expression identifies the statically-known context
342           field having the type TYPE (a C identifier).
343
344           List the available statically-known context field names with the
345           lttng-add-context(1) command.
346
347           When a field expression doesn’t exist, EXPR is false.
348
349           Examples: $ctx.prio, $ctx.preemptible, $ctx.perf:cpu:stalled-
350           cycles-frontend.
351
352       •   A $app.PROVIDER:TYPE expression identifies the application-specific
353           context field having the type TYPE (a C identifier) from the
354           provider PROVIDER (a C identifier).
355
356           When a field expression doesn’t exist, EXPR is false.
357
358           Example: $app.server:cur_user.
359
360       •   Compare strings, either string fields or string literals
361           (double-quoted), with the == and != operators.
362
363           When comparing to a string literal, the * character means “match
364           anything”. To match a literal * character, use \*.
365
366           Examples: my_field == "user34", my_field == my_other_field,
367           my_field == "192.168.*".
368
369       •   The precedence table of the operators which are supported in EXPR
370           is as follows. In this table, the highest precedence is 1:
371
372           ┌───────────┬──────────┬─────────────────┬───────────────┐
373           │Precedence │ Operator │ Description     │ Associativity │
374           ├───────────┼──────────┼─────────────────┼───────────────┤
375           │1          │ -        │ Unary minus     │ Right-to-left │
376           ├───────────┼──────────┼─────────────────┼───────────────┤
377           │1          │ +        │ Unary plus      │ Right-to-left │
378           ├───────────┼──────────┼─────────────────┼───────────────┤
379           │1          │ !        │ Logical NOT     │ Right-to-left │
380           ├───────────┼──────────┼─────────────────┼───────────────┤
381           │1          │ ~        │ Bitwise NOT     │ Right-to-left │
382           ├───────────┼──────────┼─────────────────┼───────────────┤
383           │2          │ <<       │ Bitwise left    │ Left-to-right │
384           │           │          │ shift           │               │
385           ├───────────┼──────────┼─────────────────┼───────────────┤
386           │2          │ >>       │ Bitwise right   │ Left-to-right │
387           │           │          │ shift           │               │
388           ├───────────┼──────────┼─────────────────┼───────────────┤
389           │3          │ &        │ Bitwise AND     │ Left-to-right │
390           ├───────────┼──────────┼─────────────────┼───────────────┤
391           │4          │ ^        │ Bitwise XOR     │ Left-to-right │
392           ├───────────┼──────────┼─────────────────┼───────────────┤
393           │5          │ |        │ Bitwise OR      │ Left-to-right │
394           ├───────────┼──────────┼─────────────────┼───────────────┤
395           │6          │ <        │ Less than       │ Left-to-right │
396           ├───────────┼──────────┼─────────────────┼───────────────┤
397           │6          │ <=       │ Less than or    │ Left-to-right │
398           │           │          │ equal to        │               │
399           ├───────────┼──────────┼─────────────────┼───────────────┤
400           │6          │ >        │ Greater than    │ Left-to-right │
401           ├───────────┼──────────┼─────────────────┼───────────────┤
402           │6          │ >=       │ Greater than or │ Left-to-right │
403           │           │          │ equal to        │               │
404           ├───────────┼──────────┼─────────────────┼───────────────┤
405           │7          │ ==       │ Equal to        │ Left-to-right │
406           ├───────────┼──────────┼─────────────────┼───────────────┤
407           │7          │ !=       │ Not equal to    │ Left-to-right │
408           ├───────────┼──────────┼─────────────────┼───────────────┤
409           │8          │ &&       │ Logical AND     │ Left-to-right │
410           ├───────────┼──────────┼─────────────────┼───────────────┤
411           │9          │ ||       │ Logical OR      │ Left-to-right │
412           └───────────┴──────────┴─────────────────┴───────────────┘
413           Parentheses are supported to bypass the default order.
414
415           Important
416               Unlike the C language, the bitwise AND and OR operators (& and
417               |) in EXPR take precedence over relational operators (<, <=, >,
418               >=, ==, and !=). This means the expression 2 & 2 == 2 is true
419               while the equivalent C expression is false.
420           The arithmetic operators are NOT supported.
421
422           LTTng first casts all integer constants and fields to signed 64-bit
423           integers. The representation of negative integers is two’s
424           complement. This means that, for example, the signed 8-bit integer
425           field 0xff (-1) becomes 0xffffffffffffffff (still -1) once casted.
426
427           Before a bitwise operator is applied, LTTng casts all its operands
428           to unsigned 64-bit integers, and then casts the result back to a
429           signed 64-bit integer. For the bitwise NOT operator, it’s the
430           equivalent of this C expression:
431
432               (int64_t) ~((uint64_t) val)
433
434           For the binary bitwise operators, it’s the equivalent of those
435           C expressions:
436
437               (int64_t) ((uint64_t) lhs >> (uint64_t) rhs)
438               (int64_t) ((uint64_t) lhs << (uint64_t) rhs)
439               (int64_t) ((uint64_t) lhs & (uint64_t) rhs)
440               (int64_t) ((uint64_t) lhs ^ (uint64_t) rhs)
441               (int64_t) ((uint64_t) lhs | (uint64_t) rhs)
442
443           If the right-hand side of a bitwise shift operator (<< and >>) is
444           not in the [0, 63] range, then EXPR is false.
445
446       EXPR examples:
447
448           msg_id == 23 && size >= 2048
449
450           $ctx.procname == "lttng*" && (!flag || poel < 34)
451
452           $app.my_provider:my_context == 17.34e9 || some_enum >= 14
453
454           $ctx.cpu_id == 2 && filename != "*.log"
455
456           eax_reg & 0xff7 == 0x240 && x[4] >> 12 <= 0x1234
457
458   Migration from a recording event rule specification
459       Since LTTng 2.13, what this manual page documents is the standard,
460       common way to specify an LTTng event rule.
461
462       With the lttng-enable-event(1) command, you also specify an event rule,
463       but with deprecated options and arguments.
464
465       The following table shows how to translate from the lttng-enable-
466       event(1) options and arguments to the common event rule specification
467       options:
468
469       ┌───────────────────────────┬──────────────────────────────────┐
470       │Recording event rule       │ Common event rule                │
471       │option(s)/argument(s)      │ option(s)                        │
472       ├───────────────────────────┼──────────────────────────────────┤
473       │                           │                                  │
474       │--kernel and --tracepoint  │ --type=kernel:tracepoint         │
475       ├───────────────────────────┼──────────────────────────────────┤
476       │                           │                                  │
477       │--kernel and --syscall     │ --type=kernel:syscall:entry+exit │
478       ├───────────────────────────┼──────────────────────────────────┤
479       │                           │                                  │
480       │--probe=LOC and RECORDNAME │ --type=kernel:kprobe,            │
481       │(non-option)               │ --location=LOC, and --event-     │
482       │                           │ name=RECORDNAME                  │
483       ├───────────────────────────┼──────────────────────────────────┤
484       │                           │                                  │
485       │--userspace-probe=LOC and  │ --type=kernel:uprobe,            │
486       │RECORDNAME (non-option)    │ --location=LOC, and --event-     │
487       │                           │ name=RECORDNAME                  │
488       ├───────────────────────────┼──────────────────────────────────┤
489       │                           │                                  │
490       │--function=LOC and         │ Not available as of LTTng 2.13.7 │
491       │RECORDNAME (non-option)    │                                  │
492       ├───────────────────────────┼──────────────────────────────────┤
493       │                           │                                  │
494       │--userspace and            │ --type=user:tracepoint           │
495       │--tracepoint               │                                  │
496       ├───────────────────────────┼──────────────────────────────────┤
497       │                           │                                  │
498       │--jul and --tracepoint     │ --type=jul:logging               │
499       ├───────────────────────────┼──────────────────────────────────┤
500       │                           │                                  │
501       │--log4j and --tracepoint   │ --type=log4j:logging             │
502       ├───────────────────────────┼──────────────────────────────────┤
503       │                           │                                  │
504       │--python and --tracepoint  │ --type=python:logging            │
505       ├───────────────────────────┼──────────────────────────────────┤
506       │                           │                                  │
507       │NAME (non-option)          │ --name=NAME                      │
508       ├───────────────────────────┼──────────────────────────────────┤
509       │                           │                                  │
510       │--all                      │ --name='*´ or no --name option   │
511       ├───────────────────────────┼──────────────────────────────────┤
512       │                           │                                  │
513       │--exclude=XNAME[,XNAME]... │ --exclude-name=XNAME for each    │
514       │                           │ XNAME                            │
515       ├───────────────────────────┼──────────────────────────────────┤
516       │                           │                                  │
517       │--loglevel=LOGLEVEL        │ --log-level=LOGLEVEL..           │
518       ├───────────────────────────┼──────────────────────────────────┤
519       │                           │                                  │
520       │--loglevel-only=LOGLEVEL   │ --log-level=LOGLEVEL             │
521       ├───────────────────────────┼──────────────────────────────────┤
522       │                           │                                  │
523       │--filter=EXPR              │ --filter=EXPR                    │
524       └───────────────────────────┴──────────────────────────────────┘
525

OPTIONS

527   Instrumentation point type condition
528       See the “Instrumentation point type condition” section above.
529
530       -E NAME, --event-name=NAME
531           With the --type=kernel:kprobe or --type=kernel:uprobe option, set
532           the name of the emitted events to NAME instead of the LOC argument
533           of the --location=LOC option.
534
535           Defaulting to LOC is specific to LTTng 2.13.7 and may change in the
536           future.
537
538       -L LOC, --location=LOC
539
540           With the --type=kernel:kprobe option
541               Set the location of the Linux kprobe to insert to LOC.
542
543               LOC is one of:
544
545               •   An address (0x hexadecimal prefix supported).
546
547               •   A symbol name.
548
549               •   A symbol name and an offset (SYMBOL+OFFSET format).
550
551           With the --type=kernel:uprobe option
552               Set the location of the user space probe to insert to LOC.
553
554               LOC is one of:
555
556               [elf:]PATH:SYMBOL
557                   An available symbol within a user space application or
558                   library.
559
560                   PATH
561                       Application or library path.
562
563                       One of:
564
565                       •   An absolute path.
566
567                       •   A relative path.
568
569                       •   The name of an application as found in the
570                           directories listed in the PATH environment
571                           variable.
572
573                   SYMBOL
574                       Symbol name of the function of which to instrument the
575                       entry.
576
577                       SYMBOL can be any defined code symbol in the output of
578                       the nm(1) command, including with its --dynamic option,
579                       which lists dynamic symbols.
580
581                   As of LTTng 2.13.7, not specifying elf: is equivalent to
582                   specifying it, but this default may change in the future.
583
584                   Examples:
585
586                   •   /usr/lib/libc.so.6:malloc
587
588                   •   ./myapp:createUser
589
590                   •   elf:httpd:ap_run_open_htaccess
591
592               sdt:PATH:PROVIDER:NAME
593                   A SystemTap User-level Statically Defined Tracing (USDT)
594                   probe within a user space application or library.
595
596                   PATH
597                       Application or library path.
598
599                       This can be:
600
601                       •   An absolute path.
602
603                       •   A relative path.
604
605                       •   The name of an application as found in the
606                           directories listed in the PATH environment
607                           variable.
608
609                   PROVIDER, NAME
610                       USDT provider and probe names.
611
612                       For example, with the following USDT probe:
613
614                           DTRACE_PROBE2("server", "accept_request",
615                                         request_id, ip_addr);
616
617                       The provider/probe name pair is server:accept_request.
618
619                   Example: sdt:./build/server:server:accept_request
620
621       -t TYPE, --type=TYPE
622           Only match events which LTTng creates from an instrumentation point
623           having the type TYPE.
624
625           TYPE is one of:
626
627           kernel:tracepoint
628               LTTng kernel tracepoint.
629
630               As of LTTng 2.13.7, kernel is an alias, but this may change in
631               the future.
632
633           user:tracepoint
634               LTTng user space tracepoint.
635
636               As of LTTng 2.13.7, user is an alias, but this may change in
637               the future.
638
639           kernel:syscall:entry
640               Linux system call entry.
641
642               As of LTTng 2.13.7, syscall:entry is an alias, but this may
643               change in the future.
644
645           kernel:syscall:exit
646               Linux system call exit.
647
648               As of LTTng 2.13.7, syscall:exit is an alias, but this may
649               change in the future.
650
651           kernel:syscall:entry+exit
652               Linux system call entry and exit (two distinct instrumentation
653               points).
654
655               As of LTTng 2.13.7, the following are aliases, but this may
656               change in the future:
657
658               •   syscall:entry+exit
659
660               •   kernel:syscall
661
662               •   syscall
663
664           kernel:kprobe
665               Linux kprobe.
666
667               As of LTTng 2.13.7, kprobe is an alias, but this may change in
668               the future.
669
670               You must specify the location of the kprobe to insert with the
671               --location option.
672
673               You may specify the name of the emitted events with the
674               --event-name option.
675
676           kernel:uprobe
677               Linux user space probe.
678
679               You must specify the location of the user space probe to insert
680               with the --location option.
681
682               You may specify the name of the emitted events with the
683               --event-name option.
684
685           jul:logging
686               java.util.logging logging statement.
687
688               As of LTTng 2.13.7, jul is an alias, but this may change in the
689               future.
690
691           log4j:logging
692               Apache log4j logging statement.
693
694               As of LTTng 2.13.7, log4j is an alias, but this may change in
695               the future.
696
697           python:logging
698               Python logging statement.
699
700               As of LTTng 2.13.7, python is an alias, but this may change in
701               the future.
702
703   Event name condition
704       See the “Event name condition” section above.
705
706       -n NAME, --name=NAME
707           Only match events of which NAME matches, depending on the argument
708           of the --type option:
709
710           kernel:tracepoint, user:tracepoint
711               The full name of the LTTng tracepoint.
712
713           jul:logging, log4j:logging, python:logging
714               The Java or Python logger name.
715
716           kernel:syscall:entry, kernel:syscall:exit,
717           kernel:syscall:entry+exit
718               The name of the system call, without any sys_ prefix.
719
720           This option is NOT available with other instrumentation point
721           types.
722
723           As of LTTng 2.13.7, not specifying this option is equivalent to
724           specifying --name='*´ (when it applies), but this default may
725           change in the future.
726
727       -x XNAME, --exclude-name=XNAME
728           Only match events of which XNAME does NOT match the full name of
729           the LTTng user space tracepoint.
730
731           Only available with the --type=user:tracepoint option.
732
733       NAME and XNAME are globbing patterns: the * character means “match
734       anything”. To match a literal * character, use \*.
735
736   Instrumentation point log level condition
737       See the “Instrumentation point log level condition” section above.
738
739       -l LOGLEVELSPEC, --log-level=LOGLEVELSPEC
740           Only match events of which the log level of the LTTng tracepoint or
741           logging statement is, depending on the format of LOGLEVELSPEC:
742
743           LOGLEVEL..
744               At least as severe as LOGLEVEL.
745
746           LOGLEVEL
747               Exactly LOGLEVEL.
748
749           ..
750               Anything.
751
752           This option is NOT available with the following options:
753
754           •   --type=kernel:tracepoint
755
756           •   --type=kernel:syscall:entry
757
758           •   --type=kernel:syscall:exit
759
760           •   --type=kernel:syscall:entry+exit
761
762           •   --type=kernel:kprobe
763
764           •   --type=kernel:uprobe
765
766               As of LTTng 2.13.7, not specifying this option is equivalent to
767               specifying --log-level=..  (when it applies), but this default
768               may change in the future.
769
770   Event payload and context filter condition
771       See the “Event payload and context filter condition” section above.
772
773       -f EXPR, --filter=EXPR
774           Only match events of which EXPR, which can contain references to
775           event payload and current context fields, is true.
776
777           This option is only available with the following options:
778
779           •   --type=kernel:tracepoint
780
781           •   --type=kernel:syscall:entry
782
783           •   --type=kernel:syscall:exit
784
785           •   --type=kernel:syscall:entry+exit
786

RESOURCES

788       •   LTTng project website <https://lttng.org>
789
790       •   LTTng documentation <https://lttng.org/docs>
791
792       •   LTTng bug tracker <https://bugs.lttng.org>
793
794       •   Git repositories <https://git.lttng.org>
795
796       •   GitHub organization <https://github.com/lttng>
797
798       •   Continuous integration <https://ci.lttng.org/>
799
800       •   Mailing list <https://lists.lttng.org/> for support and
801           development: lttng-dev@lists.lttng.org
802
803       •   IRC channel <irc://irc.oftc.net/lttng>: #lttng on irc.oftc.net
804

COPYRIGHT

806       This program is part of the LTTng-tools project.
807
808       LTTng-tools is distributed under the GNU General Public License
809       version 2 <http://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html>.
810       See the LICENSE <https://github.com/lttng/lttng-
811       tools/blob/master/LICENSE> file for details.
812

THANKS

814       Special thanks to Michel Dagenais and the DORSAL laboratory
815       <http://www.dorsal.polymtl.ca/> at École Polytechnique de Montréal for
816       the LTTng journey.
817
818       Also thanks to the Ericsson teams working on tracing which helped us
819       greatly with detailed bug reports and unusual test cases.
820