Re: Trace event filtering

On Thu, Jun 13, 2019 at 11:02 AM Steven Rostedt <[email protected]> wrote:
>
> On Thu, 13 Jun 2019 10:43:22 -0700
> Cong Wang <[email protected]> wrote:
>
> > Hi, all
>
> Hi Cong,
>
> >
> > I have a simple question about filters in libtraceevent. It looks like
> > libtraceevent parses and matches filters in user-space, but kernel
> > already implements filtering in kernel-space which is better because
> > it should prevent events from generating, if not matched. So why
> > doesn't libtraceevent use kernel filters?
>
> The libtraceevent library is made to process the data after it has been
> recorded. It is not the library for use of starting the recording,
> hence there's no reason to make it use kernel filtering.

I see, I thought there is a libtraceevent API to use kernel filters too, so
it is actually designed not to use kernel filters, from what you said.

>
> >
> > I am trying to filter out non-error block_rq_complete events, clearly
> > I don't want to see rasdaemon woken up every time for error==0 case,
> > which is literally all the time.
>
> You can do that by this:
>
>   echo 'error != 0' > /sys/kernel/tracing/events/block/block_rq_complete/filter
>
> Note, trace-cmd does this, and we are working on making a libftrace.so
> (hopefully it will be out this year) that will allow you to do this
> easily from any application.

Yeah, before sending out the question I actually verified that rasdaemon
won't be woken up with that kernel fitler set.

So, I will have to implement this by myself, fortunately it is not hard.

>
> >
> > BTW, the user-space filters have slightly different syntax with
> > kernel-space filters, at least the regex matching looks slightly
> > different to me.
>
> Yes, the parsing in the kernel is very limited, but for userspace, we
> have the regex (man regex) at our disposal, that the kernel does not
> have. Thus, we use that powerful engine. Unfortunately, that means that
> the kernel and the userspace filtering will be different.

Right.

>
> >
> > Am I miss anything here?
>
> Did that answer all your questions?

Yes.

Thanks!