Fun with Dynamic Kernel Tracing Events

Static tracing events have been in the kernel since Linux v2.6.31. They are extremely useful, and today with over 1000 static events in the Linux kernel, they are common and well known. Even with so m …

Static tracing events have been in the kernel since Linux v2.6.31. They are extremely useful, and today with over 1000 static events in the Linux kernel, they are common and well known. Even with so many events, there’s always something else in the kernel that one would like to know about. This is where dynamic events can become handy. Not as well known are kprobe events. These are events that can be created dynamically, and have been available since v2.6.33. But they can be difficult to use, and change from kernel build to kernel build. Coming soon are function based events, where they are tied to the function tracer, and you can created events based on function arguments. This talk will discuss the crazy things you can do with function based events as well as kprobe events.