function::ftrace - Linux

Overview

ftrace is a powerful Linux command for tracing kernel events and functions. It allows developers and system administrators to monitor the execution flow of kernel code, identify performance bottlenecks, and troubleshoot system issues.

Syntax

ftrace [options] <command> [<args>]

Options/Flags

  • -o: Output file. Redirects output to a specified file instead of the terminal.
  • -a: All events. Enables tracing of all available kernel events.
  • -c: Tracepoints only. Limits tracing to tracepoints only.
  • -f: Function only. Limits tracing to function entries and exits only.
  • -p: PID. Traces the specified process ID.
  • -T: Duration. Sets the duration of tracing in seconds.
  • -s: Snapshots. Number of snapshots to take (used with -a).
  • -i: Interval. Snapshot interval in microseconds (used with -a and -s).

Examples

  • Trace all kernel events: ftrace -a
  • Trace only tracepoints: ftrace -c
  • Trace function entries and exits for process 123: ftrace -p 123 -f
  • Trace events for 10 seconds and save to "trace.log": ftrace -T 10 -o trace.log
  • Take 100 snapshots of all events every 100 microseconds: ftrace -a -s 100 -i 100

Common Issues

  • Permission denied: Ensure you have root privileges to run ftrace.
  • No events recorded: Check if the kernel module ftrace is loaded.
  • No output file created: If using -o, ensure that the output path is valid and has write permissions.

Integration

  • Perf: Use ftrace with perf record to trace kernel events and profile kernel execution.
  • LTTng: Combine ftrace with LTTng for advanced tracing and analysis.
  • Trace-cmd: Use trace-cmd record to record kernel events and then analyze them with trace-cmd report.

Related Commands

  • dmesg
  • journalctl
  • perf
  • LTTng