1LTTNG-EVENT-RULE(7) LTTng Manual LTTNG-EVENT-RULE(7)
2
3
4
6 lttng-event-rule - Common LTTng event rule specification
7
9 Specify an event rule to match Linux kernel tracepoint or system call
10 events:
11
12 --type=(kernel:tracepoint | kernel:syscall[:entry|:exit|:entry+exit])]
13 [--name=NAME] [--filter=EXPR]
14
15 Specify an event rule to match Linux kernel kprobe or user space probe
16 events:
17
18 --type=(kernel:kprobe | kernel:uprobe) --location=LOC
19 [--event-name=EVENTNAME]
20
21 Specify an event rule to match user space tracepoint events:
22
23 --type=user:tracepoint [--name=NAME] [--exclude-name=XNAME]...
24 [--log-level=(LOGLEVEL | LOGLEVEL.. | ..)] [--filter=EXPR]
25
26 Specify an event rule to match Java/Python logging events:
27
28 --type=(jul | log4j | python):logging [--name=NAME]
29 [--log-level=(LOGLEVEL | LOGLEVEL.. | ..)] [--filter=EXPR]
30
32 This manual page shows how to specify an LTTng event rule on the
33 command line.
34
35 As of LTTng 2.13.10, the command-line options documented here only
36 apply to the event-rule-matches trigger condition specifier (see lttng-
37 add-trigger(1)).
38
39 See lttng-concepts(7) to learn more about instrumentation points,
40 events, and event rules.
41
42 Note
43 This manual page only describes the common event rule options. The
44 lttng(1) commands which require an event rule specification may
45 accept or require other options and arguments, depending on the
46 context.
47
48 For example, the lttng-add-trigger(1) command also accepts
49 --capture options with the event-rule-matches trigger condition.
50
51 Overview of event rule condtions
52 For LTTng to emit an event E, E must satisfy all the conditions of an
53 event rule, that is:
54
55 • The instrumentation point from which LTTng creates E has a specific
56 type.
57
58 See the “Instrumentation point type condition” section below.
59
60 • A pattern matches the name of E while another pattern doesn’t.
61
62 See the “Event name condition” section below.
63
64 • The log level of the instrumentation point from which LTTng
65 creates E is at least as severe as some value, or is exactly some
66 value.
67
68 See the “Instrumentation point log level condition” section below.
69
70 • The fields of the payload of E and the current context fields
71 satisfy a filter expression.
72
73 See the “Event payload and context filter condition” section below.
74
75 The dedicated command-line options of most conditions are optional: if
76 you don’t specify the option, the associated condition is always
77 satisfied.
78
79 Instrumentation point type condition
80 An event E satisfies the instrumentation point type condition of an
81 event rule if the instrumentation point from which LTTng creates E is,
82 depending on the argument of the --type option:
83
84 kernel:tracepoint
85 An LTTng kernel tracepoint, that is, a statically defined point in
86 the source code of the kernel image or of a kernel module with
87 LTTng kernel tracer macros.
88
89 List the available Linux kernel tracepoints with lttng list
90 --kernel. See lttng-list(1) to learn more.
91
92 kernel:syscall:entry, kernel:syscall:exit, kernel:syscall:entry+exit
93 The entry, exit, or entry and exit of a Linux kernel system call.
94
95 List the available Linux kernel system call instrumentation points
96 with lttng list --kernel --syscall. See lttng-list(1) to learn
97 more.
98
99 kernel:kprobe
100 A Linux kprobe, that is, a single probe dynamically placed in the
101 compiled kernel code.
102
103 You must specify the kprobe location with the --location option.
104
105 The payload of a Linux kprobe event is empty.
106
107 kernel:uprobe
108 A Linux user space probe, that is, a single probe dynamically
109 placed at the entry of a compiled user space application/library
110 function through the kernel.
111
112 LTTng 2.13.10 supports the ELF and SystemTap User-level Statically
113 Defined Tracing (USDT; a DTrace-style marker) probing methods.
114 LTTng only supports USDT probes which are NOT reference-counted.
115
116 You must specify the user space probe location with the --location
117 option.
118
119 The payload of a Linux user space probe event is empty.
120
121 user:tracepoint
122 An LTTng user space tracepoint, that is, a statically defined point
123 in the source code of a C/C++ application/library with LTTng user
124 space tracer macros.
125
126 List the available user space tracepoints with lttng list
127 --userspace. See lttng-list(1) to learn more.
128
129 jul:logging
130 A java.util.logging logging statement.
131
132 List the available java.util.logging loggers with lttng list --jul
133 See lttng-list(1) to learn more.
134
135 log4j:logging
136 An Apache log4j logging statement.
137
138 List the available Apache log4j loggers with lttng list --log4j See
139 lttng-list(1) to learn more.
140
141 python:logging
142 A Python logging statement.
143
144 List the available Python loggers with lttng list --python See
145 lttng-list(1) to learn more.
146
147 Event name condition
148 An event E satisfies the event name condition of an event rule ER if
149 the two following statements are true:
150
151 • You don’t specify the --name=NAME option or, depending on the
152 instrumentation type condition (see the “Instrumentation point type
153 condition” section above) of ER, NAME matches:
154
155 kernel:tracepoint, user:tracepoint
156 The full name of the tracepoint from which LTTng creates E.
157
158 Note that the full name of a user space tracepoint is
159 PROVIDER:NAME, where PROVIDER is the tracepoint provider name
160 and NAME is the tracepoint name.
161
162 jul:logging, log4j:logging, python:logging
163 The name of the Java or Python logger from which LTTng
164 creates E.
165
166 kernel:syscall:entry, kernel:syscall:exit,
167 kernel:syscall:entry+exit
168 The name of the system call, without any sys_ prefix, from
169 which LTTng creates E.
170
171 • You don’t specify any --exclude-name=XNAME option or none of the
172 XNAME arguments matches the full name of the user space tracepoint
173 from which LTTng creates E.
174
175 The --exclude-name option is only available with the
176 --type=user:tracepoint option.
177
178 This condition is only meaningful for the LTTng tracepoint, logging
179 statement, and Linux system call instrumentation point types: it’s
180 always satisfied for the other types.
181
182 In all cases, NAME and XNAME are globbing patterns: the * character
183 means “match anything”. To match a literal * character, use \*.
184
185 Important
186 Make sure to single-quote NAME and XNAME when they contain the *
187 character and when you run an lttng(1) command from a shell.
188
189 As of LTTng 2.13.10, not specifying the --name option is equivalent to
190 specifying --name='*´, but this default may change in the future.
191
192 Instrumentation point log level condition
193 An event E satisfies the instrumentation point log level condition of
194 an event rule if either:
195
196 • You specify the --log-level=.. option or you don’t specify the
197 --log-level option.
198
199 Defaulting to --log-level=.. when you don’t specify the --log-
200 level option is specific to LTTng 2.13.10 and may change in the
201 future.
202
203 • The log level of the LTTng user space tracepoint or logging
204 statement from which LTTng creates E is:
205
206 With the --log-level=LOGLEVEL.. option
207 At least as severe as LOGLEVEL.
208
209 With the --log-level=LOGLEVEL option
210 Exactly LOGLEVEL.
211
212 As of LTTng 2.13.10, the ..LOGLEVEL and LOGLEVEL..LOGLEVEL formats are
213 NOT supported.
214
215 This condition is only meaningful for the LTTng user space tracepoint
216 and logging statement instrumentation point types: it’s always
217 satisfied for other types.
218
219 The available values of LOGLEVEL are, depending on the argument of the
220 --type option, from the most to the least severe:
221
222 user:tracepoint
223
224 • EMERG (0)
225
226 • ALERT (1)
227
228 • CRIT (2)
229
230 • ERR (3)
231
232 • WARNING (4)
233
234 • NOTICE (5)
235
236 • INFO (6)
237
238 • DEBUG_SYSTEM (7)
239
240 • DEBUG_PROGRAM (8)
241
242 • DEBUG_PROCESS (9)
243
244 • DEBUG_MODULE (10)
245
246 • DEBUG_UNIT (11)
247
248 • DEBUG_FUNCTION (12)
249
250 • DEBUG_LINE (13)
251
252 • DEBUG (14)
253
254 jul:logging
255
256 • OFF (INT32_MAX)
257
258 • SEVERE (1000)
259
260 • WARNING (900)
261
262 • INFO (800)
263
264 • CONFIG (700)
265
266 • FINE (500)
267
268 • FINER (400)
269
270 • FINEST (300)
271
272 • ALL (INT32_MIN)
273
274 log4j:logging
275
276 • OFF (INT32_MAX)
277
278 • FATAL (50000)
279
280 • ERROR (40000)
281
282 • WARN (30000)
283
284 • INFO (20000)
285
286 • DEBUG (10000)
287
288 • TRACE (5000)
289
290 • ALL (INT32_MIN)
291
292 python:logging
293
294 • CRITICAL (50)
295
296 • ERROR (40)
297
298 • WARNING (30)
299
300 • INFO (20)
301
302 • DEBUG (10)
303
304 • NOTSET (0)
305
306 Event payload and context filter condition
307 An event E satisfies the event payload and context filter condition of
308 an event rule if the --filter=EXPR option is missing or if EXPR is
309 true.
310
311 This condition is only meaningful for the LTTng tracepoint and Linux
312 system call instrumentation point types: it’s always satisfied for
313 other types.
314
315 EXPR can contain references to the payload fields of E and to the
316 current context fields.
317
318 Important
319 Make sure to single-quote EXPR when you run an lttng(1) command
320 from a shell, as filter expressions typically include characters
321 having a special meaning for most shells.
322
323 The expected syntax of EXPR is similar to the syntax of a C language
324 conditional expression (an expression which an if statement can
325 evaluate), but there are a few differences:
326
327 • A NAME expression identifies an event payload field named NAME (a
328 C identifier).
329
330 Use the C language dot and square bracket notations to access
331 nested structure and array/sequence fields. You can only use a
332 constant, positive integer number within square brackets. If the
333 index is out of bounds, EXPR is false.
334
335 The value of an enumeration field is an integer.
336
337 When a field expression doesn’t exist, EXPR is false.
338
339 Examples: my_field, target_cpu, seq[7], msg.user[1].data[2][17].
340
341 • A $ctx.TYPE expression identifies the statically-known context
342 field having the type TYPE (a C identifier).
343
344 List the available statically-known context field names with the
345 lttng-add-context(1) command.
346
347 When a field expression doesn’t exist, EXPR is false.
348
349 Examples: $ctx.prio, $ctx.preemptible, $ctx.perf:cpu:stalled-
350 cycles-frontend.
351
352 • A $app.PROVIDER:TYPE expression identifies the application-specific
353 context field having the type TYPE (a C identifier) from the
354 provider PROVIDER (a C identifier).
355
356 When a field expression doesn’t exist, EXPR is false.
357
358 Example: $app.server:cur_user.
359
360 • Compare strings, either string fields or string literals
361 (double-quoted), with the == and != operators.
362
363 When comparing to a string literal, the * character means “match
364 anything”. To match a literal * character, use \*.
365
366 Examples: my_field == "user34", my_field == my_other_field,
367 my_field == "192.168.*".
368
369 • The precedence table of the operators which are supported in EXPR
370 is as follows. In this table, the highest precedence is 1:
371
372 ┌───────────┬──────────┬─────────────────┬───────────────┐
373 │Precedence │ Operator │ Description │ Associativity │
374 ├───────────┼──────────┼─────────────────┼───────────────┤
375 │1 │ - │ Unary minus │ Right-to-left │
376 ├───────────┼──────────┼─────────────────┼───────────────┤
377 │1 │ + │ Unary plus │ Right-to-left │
378 ├───────────┼──────────┼─────────────────┼───────────────┤
379 │1 │ ! │ Logical NOT │ Right-to-left │
380 ├───────────┼──────────┼─────────────────┼───────────────┤
381 │1 │ ~ │ Bitwise NOT │ Right-to-left │
382 ├───────────┼──────────┼─────────────────┼───────────────┤
383 │2 │ << │ Bitwise left │ Left-to-right │
384 │ │ │ shift │ │
385 ├───────────┼──────────┼─────────────────┼───────────────┤
386 │2 │ >> │ Bitwise right │ Left-to-right │
387 │ │ │ shift │ │
388 ├───────────┼──────────┼─────────────────┼───────────────┤
389 │3 │ & │ Bitwise AND │ Left-to-right │
390 ├───────────┼──────────┼─────────────────┼───────────────┤
391 │4 │ ^ │ Bitwise XOR │ Left-to-right │
392 ├───────────┼──────────┼─────────────────┼───────────────┤
393 │5 │ | │ Bitwise OR │ Left-to-right │
394 ├───────────┼──────────┼─────────────────┼───────────────┤
395 │6 │ < │ Less than │ Left-to-right │
396 ├───────────┼──────────┼─────────────────┼───────────────┤
397 │6 │ <= │ Less than or │ Left-to-right │
398 │ │ │ equal to │ │
399 ├───────────┼──────────┼─────────────────┼───────────────┤
400 │6 │ > │ Greater than │ Left-to-right │
401 ├───────────┼──────────┼─────────────────┼───────────────┤
402 │6 │ >= │ Greater than or │ Left-to-right │
403 │ │ │ equal to │ │
404 ├───────────┼──────────┼─────────────────┼───────────────┤
405 │7 │ == │ Equal to │ Left-to-right │
406 ├───────────┼──────────┼─────────────────┼───────────────┤
407 │7 │ != │ Not equal to │ Left-to-right │
408 ├───────────┼──────────┼─────────────────┼───────────────┤
409 │8 │ && │ Logical AND │ Left-to-right │
410 ├───────────┼──────────┼─────────────────┼───────────────┤
411 │9 │ || │ Logical OR │ Left-to-right │
412 └───────────┴──────────┴─────────────────┴───────────────┘
413 Parentheses are supported to bypass the default order.
414
415 Important
416 Unlike the C language, the bitwise AND and OR operators (& and
417 |) in EXPR take precedence over relational operators (<, <=, >,
418 >=, ==, and !=). This means the expression 2 & 2 == 2 is true
419 while the equivalent C expression is false.
420 The arithmetic operators are NOT supported.
421
422 LTTng first casts all integer constants and fields to signed 64-bit
423 integers. The representation of negative integers is two’s
424 complement. This means that, for example, the signed 8-bit integer
425 field 0xff (-1) becomes 0xffffffffffffffff (still -1) once casted.
426
427 Before a bitwise operator is applied, LTTng casts all its operands
428 to unsigned 64-bit integers, and then casts the result back to a
429 signed 64-bit integer. For the bitwise NOT operator, it’s the
430 equivalent of this C expression:
431
432 (int64_t) ~((uint64_t) val)
433
434 For the binary bitwise operators, it’s the equivalent of those
435 C expressions:
436
437 (int64_t) ((uint64_t) lhs >> (uint64_t) rhs)
438 (int64_t) ((uint64_t) lhs << (uint64_t) rhs)
439 (int64_t) ((uint64_t) lhs & (uint64_t) rhs)
440 (int64_t) ((uint64_t) lhs ^ (uint64_t) rhs)
441 (int64_t) ((uint64_t) lhs | (uint64_t) rhs)
442
443 If the right-hand side of a bitwise shift operator (<< and >>) is
444 not in the [0, 63] range, then EXPR is false.
445
446 EXPR examples:
447
448 msg_id == 23 && size >= 2048
449
450 $ctx.procname == "lttng*" && (!flag || poel < 34)
451
452 $app.my_provider:my_context == 17.34e9 || some_enum >= 14
453
454 $ctx.cpu_id == 2 && filename != "*.log"
455
456 eax_reg & 0xff7 == 0x240 && x[4] >> 12 <= 0x1234
457
458 Migration from a recording event rule specification
459 Since LTTng 2.13, what this manual page documents is the standard,
460 common way to specify an LTTng event rule.
461
462 With the lttng-enable-event(1) command, you also specify an event rule,
463 but with deprecated options and arguments.
464
465 The following table shows how to translate from the lttng-enable-
466 event(1) options and arguments to the common event rule specification
467 options:
468
469 ┌───────────────────────────┬──────────────────────────────────┐
470 │Recording event rule │ Common event rule │
471 │option(s)/argument(s) │ option(s) │
472 ├───────────────────────────┼──────────────────────────────────┤
473 │ │ │
474 │--kernel and --tracepoint │ --type=kernel:tracepoint │
475 ├───────────────────────────┼──────────────────────────────────┤
476 │ │ │
477 │--kernel and --syscall │ --type=kernel:syscall:entry+exit │
478 ├───────────────────────────┼──────────────────────────────────┤
479 │ │ │
480 │--probe=LOC and RECORDNAME │ --type=kernel:kprobe, │
481 │(non-option) │ --location=LOC, and --event- │
482 │ │ name=RECORDNAME │
483 ├───────────────────────────┼──────────────────────────────────┤
484 │ │ │
485 │--userspace-probe=LOC and │ --type=kernel:uprobe, │
486 │RECORDNAME (non-option) │ --location=LOC, and --event- │
487 │ │ name=RECORDNAME │
488 ├───────────────────────────┼──────────────────────────────────┤
489 │ │ │
490 │--function=LOC and │ Not available as of │
491 │RECORDNAME (non-option) │ LTTng 2.13.10 │
492 ├───────────────────────────┼──────────────────────────────────┤
493 │ │ │
494 │--userspace and │ --type=user:tracepoint │
495 │--tracepoint │ │
496 ├───────────────────────────┼──────────────────────────────────┤
497 │ │ │
498 │--jul and --tracepoint │ --type=jul:logging │
499 ├───────────────────────────┼──────────────────────────────────┤
500 │ │ │
501 │--log4j and --tracepoint │ --type=log4j:logging │
502 ├───────────────────────────┼──────────────────────────────────┤
503 │ │ │
504 │--python and --tracepoint │ --type=python:logging │
505 ├───────────────────────────┼──────────────────────────────────┤
506 │ │ │
507 │NAME (non-option) │ --name=NAME │
508 ├───────────────────────────┼──────────────────────────────────┤
509 │ │ │
510 │--all │ --name='*´ or no --name option │
511 ├───────────────────────────┼──────────────────────────────────┤
512 │ │ │
513 │--exclude=XNAME[,XNAME]... │ --exclude-name=XNAME for each │
514 │ │ XNAME │
515 ├───────────────────────────┼──────────────────────────────────┤
516 │ │ │
517 │--loglevel=LOGLEVEL │ --log-level=LOGLEVEL.. │
518 ├───────────────────────────┼──────────────────────────────────┤
519 │ │ │
520 │--loglevel-only=LOGLEVEL │ --log-level=LOGLEVEL │
521 ├───────────────────────────┼──────────────────────────────────┤
522 │ │ │
523 │--filter=EXPR │ --filter=EXPR │
524 └───────────────────────────┴──────────────────────────────────┘
525
527 Instrumentation point type condition
528 See the “Instrumentation point type condition” section above.
529
530 -E NAME, --event-name=NAME
531 With the --type=kernel:kprobe or --type=kernel:uprobe option, set
532 the name of the emitted events to NAME instead of the LOC argument
533 of the --location=LOC option.
534
535 Defaulting to LOC is specific to LTTng 2.13.10 and may change in
536 the future.
537
538 -L LOC, --location=LOC
539
540 With the --type=kernel:kprobe option
541 Set the location of the Linux kprobe to insert to LOC.
542
543 LOC is one of:
544
545 • An address (0x hexadecimal prefix supported).
546
547 • A symbol name.
548
549 • A symbol name and an offset (SYMBOL+OFFSET format).
550
551 With the --type=kernel:uprobe option
552 Set the location of the user space probe to insert to LOC.
553
554 LOC is one of:
555
556 [elf:]PATH:SYMBOL
557 An available symbol within a user space application or
558 library.
559
560 PATH
561 Application or library path.
562
563 One of:
564
565 • An absolute path.
566
567 • A relative path.
568
569 • The name of an application as found in the
570 directories listed in the PATH environment
571 variable.
572
573 SYMBOL
574 Symbol name of the function of which to instrument the
575 entry.
576
577 SYMBOL can be any defined code symbol in the output of
578 the nm(1) command, including with its --dynamic option,
579 which lists dynamic symbols.
580
581 As of LTTng 2.13.10, not specifying elf: is equivalent to
582 specifying it, but this default may change in the future.
583
584 Examples:
585
586 • /usr/lib/libc.so.6:malloc
587
588 • ./myapp:createUser
589
590 • elf:httpd:ap_run_open_htaccess
591
592 sdt:PATH:PROVIDER:NAME
593 A SystemTap User-level Statically Defined Tracing (USDT)
594 probe within a user space application or library.
595
596 PATH
597 Application or library path.
598
599 This can be:
600
601 • An absolute path.
602
603 • A relative path.
604
605 • The name of an application as found in the
606 directories listed in the PATH environment
607 variable.
608
609 PROVIDER, NAME
610 USDT provider and probe names.
611
612 For example, with the following USDT probe:
613
614 DTRACE_PROBE2("server", "accept_request",
615 request_id, ip_addr);
616
617 The provider/probe name pair is server:accept_request.
618
619 Example: sdt:./build/server:server:accept_request
620
621 -t TYPE, --type=TYPE
622 Only match events which LTTng creates from an instrumentation point
623 having the type TYPE.
624
625 TYPE is one of:
626
627 kernel:tracepoint
628 LTTng kernel tracepoint.
629
630 As of LTTng 2.13.10, kernel is an alias, but this may change in
631 the future.
632
633 user:tracepoint
634 LTTng user space tracepoint.
635
636 As of LTTng 2.13.10, user is an alias, but this may change in
637 the future.
638
639 kernel:syscall:entry
640 Linux system call entry.
641
642 As of LTTng 2.13.10, syscall:entry is an alias, but this may
643 change in the future.
644
645 kernel:syscall:exit
646 Linux system call exit.
647
648 As of LTTng 2.13.10, syscall:exit is an alias, but this may
649 change in the future.
650
651 kernel:syscall:entry+exit
652 Linux system call entry and exit (two distinct instrumentation
653 points).
654
655 As of LTTng 2.13.10, the following are aliases, but this may
656 change in the future:
657
658 • syscall:entry+exit
659
660 • kernel:syscall
661
662 • syscall
663
664 kernel:kprobe
665 Linux kprobe.
666
667 As of LTTng 2.13.10, kprobe is an alias, but this may change in
668 the future.
669
670 You must specify the location of the kprobe to insert with the
671 --location option.
672
673 You may specify the name of the emitted events with the
674 --event-name option.
675
676 kernel:uprobe
677 Linux user space probe.
678
679 You must specify the location of the user space probe to insert
680 with the --location option.
681
682 You may specify the name of the emitted events with the
683 --event-name option.
684
685 jul:logging
686 java.util.logging logging statement.
687
688 As of LTTng 2.13.10, jul is an alias, but this may change in
689 the future.
690
691 log4j:logging
692 Apache log4j logging statement.
693
694 As of LTTng 2.13.10, log4j is an alias, but this may change in
695 the future.
696
697 python:logging
698 Python logging statement.
699
700 As of LTTng 2.13.10, python is an alias, but this may change in
701 the future.
702
703 Event name condition
704 See the “Event name condition” section above.
705
706 -n NAME, --name=NAME
707 Only match events of which NAME matches, depending on the argument
708 of the --type option:
709
710 kernel:tracepoint, user:tracepoint
711 The full name of the LTTng tracepoint.
712
713 jul:logging, log4j:logging, python:logging
714 The Java or Python logger name.
715
716 kernel:syscall:entry, kernel:syscall:exit,
717 kernel:syscall:entry+exit
718 The name of the system call, without any sys_ prefix.
719
720 This option is NOT available with other instrumentation point
721 types.
722
723 As of LTTng 2.13.10, not specifying this option is equivalent to
724 specifying --name='*´ (when it applies), but this default may
725 change in the future.
726
727 -x XNAME, --exclude-name=XNAME
728 Only match events of which XNAME does NOT match the full name of
729 the LTTng user space tracepoint.
730
731 Only available with the --type=user:tracepoint option.
732
733 NAME and XNAME are globbing patterns: the * character means “match
734 anything”. To match a literal * character, use \*.
735
736 Instrumentation point log level condition
737 See the “Instrumentation point log level condition” section above.
738
739 -l LOGLEVELSPEC, --log-level=LOGLEVELSPEC
740 Only match events of which the log level of the LTTng tracepoint or
741 logging statement is, depending on the format of LOGLEVELSPEC:
742
743 LOGLEVEL..
744 At least as severe as LOGLEVEL.
745
746 LOGLEVEL
747 Exactly LOGLEVEL.
748
749 ..
750 Anything.
751
752 This option is NOT available with the following options:
753
754 • --type=kernel:tracepoint
755
756 • --type=kernel:syscall:entry
757
758 • --type=kernel:syscall:exit
759
760 • --type=kernel:syscall:entry+exit
761
762 • --type=kernel:kprobe
763
764 • --type=kernel:uprobe
765
766 As of LTTng 2.13.10, not specifying this option is equivalent
767 to specifying --log-level=.. (when it applies), but this
768 default may change in the future.
769
770 Event payload and context filter condition
771 See the “Event payload and context filter condition” section above.
772
773 -f EXPR, --filter=EXPR
774 Only match events of which EXPR, which can contain references to
775 event payload and current context fields, is true.
776
777 This option is only available with the following options:
778
779 • --type=kernel:tracepoint
780
781 • --type=kernel:syscall:entry
782
783 • --type=kernel:syscall:exit
784
785 • --type=kernel:syscall:entry+exit
786
788 • LTTng project website <https://lttng.org>
789
790 • LTTng documentation <https://lttng.org/docs>
791
792 • LTTng bug tracker <https://bugs.lttng.org>
793
794 • Git repositories <https://git.lttng.org>
795
796 • GitHub organization <https://github.com/lttng>
797
798 • Continuous integration <https://ci.lttng.org/>
799
800 • Mailing list <https://lists.lttng.org/> for support and
801 development: lttng-dev@lists.lttng.org
802
803 • IRC channel <irc://irc.oftc.net/lttng>: #lttng on irc.oftc.net
804
806 This program is part of the LTTng-tools project.
807
808 LTTng-tools is distributed under the GNU General Public License
809 version 2 <http://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html>.
810 See the LICENSE <https://github.com/lttng/lttng-
811 tools/blob/master/LICENSE> file for details.
812
814 Special thanks to Michel Dagenais and the DORSAL laboratory
815 <http://www.dorsal.polymtl.ca/> at École Polytechnique de Montréal for
816 the LTTng journey.
817
818 Also thanks to the Ericsson teams working on tracing which helped us
819 greatly with detailed bug reports and unusual test cases.
820
822 lttng(1), lttng-add-trigger(1), lttng-list(1), lttng-concepts(7)
823
824
825
826LTTng 2.13.10 18 May 2021 LTTNG-EVENT-RULE(7)