On Thu, Jun 13, 2019 at 11:02 AM Steven Rostedt <rostedt@xxxxxxxxxxx> wrote: > > On Thu, 13 Jun 2019 10:43:22 -0700 > Cong Wang <xiyou.wangcong@xxxxxxxxx> wrote: > > > Hi, all > > Hi Cong, > > > > > I have a simple question about filters in libtraceevent. It looks like > > libtraceevent parses and matches filters in user-space, but kernel > > already implements filtering in kernel-space which is better because > > it should prevent events from generating, if not matched. So why > > doesn't libtraceevent use kernel filters? > > The libtraceevent library is made to process the data after it has been > recorded. It is not the library for use of starting the recording, > hence there's no reason to make it use kernel filtering. I see, I thought there is a libtraceevent API to use kernel filters too, so it is actually designed not to use kernel filters, from what you said. > > > > > I am trying to filter out non-error block_rq_complete events, clearly > > I don't want to see rasdaemon woken up every time for error==0 case, > > which is literally all the time. > > You can do that by this: > > echo 'error != 0' > /sys/kernel/tracing/events/block/block_rq_complete/filter > > Note, trace-cmd does this, and we are working on making a libftrace.so > (hopefully it will be out this year) that will allow you to do this > easily from any application. Yeah, before sending out the question I actually verified that rasdaemon won't be woken up with that kernel fitler set. So, I will have to implement this by myself, fortunately it is not hard. > > > > > BTW, the user-space filters have slightly different syntax with > > kernel-space filters, at least the regex matching looks slightly > > different to me. > > Yes, the parsing in the kernel is very limited, but for userspace, we > have the regex (man regex) at our disposal, that the kernel does not > have. Thus, we use that powerful engine. Unfortunately, that means that > the kernel and the userspace filtering will be different. Right. > > > > > Am I miss anything here? > > Did that answer all your questions? Yes. Thanks!
|