
Filter functions to simplify search in kernel tracing, using include and exclude lists, wildcards, and field filters to trace specific functions and measure latency with the function graph tracer.
Trace a specific process by enabling tracing in the shell to capture all system calls, then disable tracing and verify the observed calls with filters.
The lecture explains preemption, time slices, and the need_resched flag, showing how the interrupt handler decides to preempt the running task and reallocate the cpu.
Use trace_marker to allow a userspace process to write into the kernel trace buffer and synchronize tracing between userspace and kernel events.
Use the irqsoff tracer to disable interrupts on the current processor, run a ten-second busy loop, and observe max latency and the function responsible for it.
Explore advanced filter techniques in Linux kernel debugging, using common and event-specific fields to enable or ignore signal subsystem events and observe signal generated and delivered flows.
Explore event pid filtering to trace only kernel events from selected processes, learn how to enable events, view which events are enabled, and observe how removing filters broadens tracing.
explain why you cannot change the event format in this linux kernel debugging context due to read permissions and the lack of available functionality.
Explore exception events and page faults in the Linux kernel, distinguishing kernel and user faults, tracing fault entries, and observing major and minor faults.
Explore ext4 events and tracing in Linux kernel debugging; learn how i-nodes, journaling, the superblock, and file operations like create, write, copy, move, and delete are reflected in trace events.
explain how linux kernel irq events are traced, showing irq entry and exit, softirq handling, and how to filter and identify which hardware or software triggers interrupts.
Reset tracing with trace-cmd to reset the function graph and subsystem events, verify which events are enabled, observe how tracing affects performance and file access.
Use trace-cmd to filter by pid and by function, exploring function filtering, event tracing, and selective system-call tracing to observe subsystem activity during execution.
A traditional debugger allows you to inspect the system state once the system is halted
i.e., after an error has been detected, but doesn’t reveal the events leading to the error.
To understand why an event took place, the relevant context has to be restored. This requires tracing
Tracing is the process of collecting information on the activity in a working system
With tracing, program execution is recorded during run-time, allowing for later analysis of the trace
Tracing provides developers with information useful for debugging.
In this course, we will be learning ftrace, which is the official tracer of Linux Kernel in deep
What can we do using ftrace?
-----------------------------
Debugging Linux Kernel
Analyzing Latencies in Linux Kernel
Learn and observe the flow of Linux Kernel
Trace context switches
Length of the time the interrupts are disabled
And many more