I just tried the following with trace-cmd 3 on both the host and guest: guest> trace-cmd agent host> trace-cmd record -e kvm -A guest -e all ssh guest [ logged in, did an 'ls' then logged out ] I ended up with a trace.dat and trace-guest.dat But when I did: kernelshark trace.dat -a trace-guest.dat I ended up with a segfault here (in trace-input.c) static struct page *allocate_page(struct tracecmd_input *handle, int cpu, off64_t offset) { struct cpu_data *cpu_data = &handle->cpu_data[cpu]; struct page **pages; struct page *page; int index; index = (offset - cpu_data->file_offset) / handle->page_size; if (index >= cpu_data->nr_pages) { pages = realloc(cpu_data->pages, (index + 1) * sizeof(*cpu_data->pages)); if (!pages) return NULL; memset(pages + cpu_data->nr_pages, 0, (index + 1 - cpu_data->nr_pages) * sizeof(*cpu_data->pages)); cpu_data->pages = pages; cpu_data->nr_pages = index + 1; } if (cpu_data->pages[index]) { cpu_data->pages[index]->ref_count++; <<---- seg fault here! return cpu_data->pages[index]; } page = malloc(sizeof(*page)); if (!page) return NULL; It appears that it doesn't like the fact that the file is compressed. This was my worry about compressing date :-/ -- Steve