8 lttng-enable-event - Create or enable LTTng recording event rules
13 Create or enable one or more recording event rules to match Linux kernel
14 tracepoint or system call events:
17 *lttng* ['linkgenoptions:(GENERAL OPTIONS)'] *enable-event* option:--kernel [option:--tracepoint | option:--syscall]
18 (option:--all | 'NAME'[,'NAME']...) [option:--filter='EXPR']
19 [option:--session='SESSION'] [option:--channel='CHANNEL']
21 Create or enable a recording event rule to match Linux kernel events
22 created from a dynamic instrumentation point:
25 *lttng* ['linkgenoptions:(GENERAL OPTIONS)'] *enable-event* option:--kernel
26 (option:--probe='LOC' | option:--function='LOC' | option:--userspace-probe='LOC') 'RECORDNAME'
27 [option:--session='SESSION'] [option:--channel='CHANNEL']
29 Create or enable one or more recording event rules to match
30 user space tracepoint events:
33 *lttng* ['linkgenoptions:(GENERAL OPTIONS)'] *enable-event* option:--userspace [option:--tracepoint]
34 (option:--all | 'NAME'[,'NAME']...) [option:--exclude='XNAME'[,'XNAME']...]
35 [option:--loglevel='LOGLEVEL' | option:--loglevel-only='LOGLEVEL'] [option:--filter='EXPR']
36 [option:--session='SESSION'] [option:--channel='CHANNEL']
38 Create or enable one or more recording event rules to match
39 Java/Python logging events:
42 *lttng* ['linkgenoptions:(GENERAL OPTIONS)'] *enable-event* (option:--jul | option:--log4j | option:--python)
43 [option:--tracepoint] (option:--all | 'NAME'[,'NAME']...)
44 [option:--loglevel='LOGLEVEL' | option:--loglevel-only='LOGLEVEL'] [option:--filter='EXPR']
45 [option:--session='SESSION'] [option:--channel='CHANNEL']
49 The `lttng enable-event` command does one of:
51 * Create one or more recording event rules.
53 * Enable one or more disabled recording event rules.
55 See the ``<<enable,Enable a disabled recording event rule>>'' section
58 See man:lttng-concepts(7) to learn more about instrumentation points,
59 events, recording event rules, and event records.
61 The recording event rule(s) to create or enable belong to:
63 With the option:--session='SESSION' option::
64 The recording session named 'SESSION'.
66 Without the option:--session option::
67 The current recording session (see man:lttng-concepts(7) to learn
68 more about the current recording session).
70 With the option:--channel='CHANNEL' option::
71 The channel named 'CHANNEL'.
73 Without the option:--channel option::
74 The channel named `channel0`.
76 If there's already a channel for the selected recording session and
77 domain which isn't named `channel0`, the `enable-event` command fails.
78 Otherwise, it automatically creates it.
80 See the ``<<examples,EXAMPLES>>'' section below for usage examples.
82 List the recording event rules of a specific recording session
83 and/or channel with the man:lttng-list(1) and man:lttng-status(1)
86 Disable an enabled recording event rule with the
87 man:lttng-disable-event(1) command.
90 Overview of recording event rule conditions
91 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
92 For LTTng to emit and record an event{nbsp}__E__,{nbsp}__E__ must
93 satisfy *all* the conditions of a recording event rule{nbsp}__ER__, that
97 You set the following conditions when you create or
98 enable{nbsp}__ER__ with the `enable-event` command:
101 * The instrumentation point type from which LTTng creates{nbsp}__E__
104 See the ``<<inst-point-type-cond,Instrumentation point type
105 condition>>'' section below.
107 * A pattern matches the name of{nbsp}__E__ while another pattern
110 See the ``<<event-name-cond,Event name condition>>'' section below.
112 * The log level of the instrumentation point from which LTTng
113 creates{nbsp}__E__ is at least as severe as some value, or is exactly
116 See the ``<<inst-point-log-level-cond,Instrumentation point log level
117 condition>>'' section below.
119 * The fields of the payload of{nbsp}__E__ and the current context fields
120 satisfy a filter expression.
122 See the ``<<filter-cond,Event payload and context filter condition>>''
126 Implicit conditions::
129 * _ER_ itself is enabled.
131 A recording event rule is enabled on creation.
133 Enable a disabled recording event rule with the `enable-event` command.
135 * The channel to which{nbsp}__ER__ is attached is enabled.
137 A channel is enabled on creation.
139 Enable a disabled channel with the man:lttng-enable-channel(1) command.
141 * The recording session of{nbsp}__ER__ is active (started).
143 A recording session is inactive (stopped) on creation.
145 Start an inactive recording session with the man:lttng-start(1) command.
147 * The process for which LTTng creates{nbsp}__E__ is allowed to record
150 All processes are allowed to record events on recording session
153 Use the man:lttng-track(1) and man:lttng-untrack(1) commands to select
154 which processes are allowed to record events based on specific process
158 The dedicated command-line options of most conditions are optional: if
159 you don't specify the option, the associated condition is always
163 [[inst-point-type-cond]]
164 Instrumentation point type condition
165 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
166 An event{nbsp}__E__ satisfies the instrumentation point type condition
167 of a recording event rule if the instrumentation point from which LTTng
168 creates{nbsp}__E__ is:
170 For the Linux kernel tracing domain (option:--kernel option)::
171 With the option:--tracepoint option or without any other instrumentation point type option:::
172 An LTTng kernel tracepoint, that is, a statically defined point
173 in the source code of the kernel image or of a kernel module
174 with LTTng kernel tracer macros.
176 As of LTTng{nbsp}{lttng_version}, this is the default instrumentation
177 point type of the Linux kernel tracing domain, but this may change in
180 List the available Linux kernel tracepoints with `lttng list --kernel`.
181 See man:lttng-list(1) to learn more.
183 With the option:--syscall option:::
184 The entry and exit of a Linux kernel system call.
186 List the available Linux kernel system call instrumentation points with
187 `lttng list --kernel --syscall`. See man:lttng-list(1) to learn more.
189 With the option:--probe option:::
190 A Linux kprobe, that is, a single probe dynamically placed in
191 the compiled kernel code.
193 The argument of the option:--probe option is the location of the
194 kprobe to insert, either a symbol or a
195 memory address, while 'RECORDNAME' is the name of the record
196 of{nbsp}__E__ (see the ``<<er-name,Event record name>>'' section below).
198 The payload of a Linux kprobe event is empty.
200 With the option:--userspace-probe option:::
201 A Linux user space probe, that is, a single probe dynamically
202 placed at the entry of a compiled user space application/library
203 function through the kernel.
205 The argument of the option:--userspace-probe option is the location
206 of the user space probe to insert, one of:
209 * A path and symbol (ELF method).
210 * A path, provider name, and probe name (SystemTap User-level Statically
211 Defined Tracing (USDT) method; a DTrace-style marker).
213 As of LTTng{nbsp}{lttng_version}, LTTng only supports USDT probes which
214 are :not: reference-counted.
217 'RECORDNAME' is the name of the record of{nbsp}__E__ (see the
218 ``<<er-name,Event record name>>'' section below).
220 The payload of a Linux user space probe event is empty.
222 With the option:--function option:::
223 A Linux kretprobe, that is, two probes dynamically placed at the
224 entry and exit of a function in the compiled kernel code.
226 The argument of the option:--function option is the location of the
227 Linux kretprobe to insert, either a symbol or
228 a memory address, while 'RECORDNAME' is the name of the record
229 of{nbsp}__E__ (see the ``<<er-name,Event record name>>'' section below).
231 The payload of a Linux kretprobe event is empty.
233 For the user space tracing domain (option:--userspace option)::
234 With or without the option:--tracepoint option:::
235 An LTTng user space tracepoint, that is, a statically defined
236 point in the source code of a C/$$C++$$ application/library with
237 LTTng user space tracer macros.
239 As of LTTng{nbsp}{lttng_version}, this is the default and sole
240 instrumentation point type of the user space tracing domain, but this
241 may change in the future.
243 List the available user space tracepoints with `lttng list --userspace`.
244 See man:lttng-list(1) to learn more.
246 For the `java.util.logging` (option:--jul option), Apache log4j (option:--log4j option), and Python (option:--python option) tracing domains::
247 With or without the option:--tracepoint option:::
250 As of LTTng{nbsp}{lttng_version}, this is the default and sole
251 instrumentation point type of the `java.util.logging`, Apache log4j, and
252 Python tracing domains, but this may change in the future.
254 List the available Java and Python loggers with `lttng list --jul`,
255 `lttng list --log4j`, and `lttng list --python`. See man:lttng-list(1)
262 An event{nbsp}__E__ satisfies the event name condition of a recording
263 event rule{nbsp}__ER__ if the two following statements are true:
265 * You specify the option:--all option or, depending on the
266 instrumentation type condition (see the
267 ``<<inst-point-type-cond,Instrumentation point type condition>>''
268 section above) of{nbsp}__ER__, 'NAME' matches:
272 The full name of the tracepoint from which LTTng creates{nbsp}__E__.
274 Note that the full name of a user space tracepoint is
275 __PROVIDER__++:++__NAME__, where __PROVIDER__ is the tracepoint provider
276 name and __NAME__ is the tracepoint name.
279 The name of the Java or Python logger from which LTTng
283 The name of the system call, without any `sys_` prefix, from which
284 LTTng creates{nbsp}__E__.
287 * You don't specify the option:--exclude=__XNAME__[++,++__XNAME__]...
288 option or, depending on the instrumentation type condition
289 of{nbsp}__ER__, none of the 'XNAME' arguments matches the full name of
290 the user space tracepoint from which LTTng creates{nbsp}__E__.
292 The option:--exclude option is only available with the option:--userspace
295 This condition is only meaningful for the LTTng tracepoint, logging
296 statement, and Linux system call instrumentation point types: it's
297 always satisfied for the other types.
299 In all cases, 'NAME' and 'XNAME' are globbing patterns: the `*`
300 character means ``match anything''. To match a literal `*` character,
301 use :escwc:. To match a literal `,` character, use
304 IMPORTANT: Make sure to **single-quote** 'NAME' and 'XNAME' when they
305 contain the `*` character and when you run the `enable-event` command
308 With the LTTng tracepoint, logging statement, and Linux system call
309 instrumentation point types, the `enable-event` command creates or
310 enables one independent recording event rule per 'NAME' argument
311 (non-option, comma-separated). With the option:--all option, the
312 `enable-event` command creates or enables a single recording event rule.
315 [[inst-point-log-level-cond]]
316 Instrumentation point log level condition
317 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
318 An event{nbsp}__E__ satisfies the instrumentation point log level
319 condition of a recording event rule if either:
321 * The option:--loglevel and option:--loglevel-only options are
324 * The log level of the LTTng user space tracepoint or logging statement
325 which creates{nbsp}__E__ is:
326 With the option:--loglevel='LOGLEVEL' option::
327 At least as severe as 'LOGLEVEL'.
329 With the option:--loglevel-only='LOGLEVEL' option::
332 This condition is only meaningful for the LTTng user space tracepoint
333 and logging statement instrumentation point types: it's always satisfied
336 The available values of 'LOGLEVEL' are, depending on the tracing domain,
337 from the most to the least severe:
339 User space (option:--userspace option)::
349 * `DEBUG_PROGRAM` (8)
350 * `DEBUG_PROCESS` (9)
351 * `DEBUG_MODULE` (10)
353 * `DEBUG_FUNCTION` (12)
357 `java.util.logging` (option:--jul option)::
359 * `OFF` (`INT32_MAX`)
367 * `ALL` (`INT32_MIN`)
369 Apache log4j (option:--log4j option)::
371 * `OFF` (`INT32_MAX`)
378 * `ALL` (`INT32_MIN`)
380 Python (option:--python option)::
391 Event payload and context filter condition
392 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
393 An event{nbsp}__E__ satisfies the event payload and context filter
394 condition of a recording event rule if the option:--filter='EXPR'
395 option is missing or if 'EXPR' is _true_.
397 This condition is only meaningful for the LTTng tracepoint and Linux
398 system call instrumentation point types: it's always satisfied for other
401 'EXPR' can contain references to the payload fields of{nbsp}__E__ and
402 to the current context fields.
404 IMPORTANT: Make sure to **single-quote** 'EXPR' when you run the
405 `enable-event` command from a shell, as filter expressions typically
406 include characters having a special meaning for most shells.
408 The expected syntax of 'EXPR' is similar to the syntax of a
409 C{nbsp}language conditional expression (an expression which an `if`
410 statement can evaluate), but there are a few differences:
412 * A _NAME_ expression identifies an event payload field named
413 _NAME_ (a C{nbsp}identifier).
415 Use the C{nbsp}language dot and square bracket notations to access
416 nested structure and array/sequence fields. You can only use a constant,
417 positive integer number within square brackets. If the index is out of
418 bounds, 'EXPR' is _false_.
420 The value of an enumeration field is an integer.
422 When a field expression doesn't exist, 'EXPR' is _false_.
424 Examples: `my_field`, `target_cpu`, `seq[7]`, `msg.user[1].data[2][17]`.
426 * A ++$ctx.++__TYPE__ expression identifies the statically-known context
427 field having the type _TYPE_ (a C{nbsp}identifier).
429 List the available statically-known context field names with the
430 man:lttng-add-context(1) command.
432 When a field expression doesn't exist, 'EXPR' is _false_.
434 Examples: `$ctx.prio`, `$ctx.preemptible`,
435 `$ctx.perf:cpu:stalled-cycles-frontend`.
437 * A ++$app.++__PROVIDER__++:++__TYPE__ expression identifies the
438 application-specific context field having the type _TYPE_ (a
439 C{nbsp}identifier) from the provider _PROVIDER_ (a C{nbsp}identifier).
441 When a field expression doesn't exist, 'EXPR' is _false_.
443 Example: `$app.server:cur_user`.
445 * Compare strings, either string fields or string literals
446 (double-quoted), with the `==` and `!=` operators.
448 When comparing to a string literal, the `*` character means ``match
449 anything''. To match a literal `*` character, use :escwc:.
451 Examples: `my_field == "user34"`, `my_field == my_other_field`,
452 `my_field == "192.168.*"`.
454 * The precedence table of the operators which are supported in 'EXPR'
455 is as follows. In this table, the highest precedence is{nbsp}1:
459 |Precedence |Operator |Description |Associativity
460 |1 |`-` |Unary minus |Right-to-left
461 |1 |`+` |Unary plus |Right-to-left
462 |1 |`!` |Logical NOT |Right-to-left
463 |1 |`~` |Bitwise NOT |Right-to-left
464 |2 |`<<` |Bitwise left shift |Left-to-right
465 |2 |`>>` |Bitwise right shift |Left-to-right
466 |3 |`&` |Bitwise AND |Left-to-right
467 |4 |`^` |Bitwise XOR |Left-to-right
468 |5 |`\|` |Bitwise OR |Left-to-right
469 |6 |`<` |Less than |Left-to-right
470 |6 |`<=` |Less than or equal to |Left-to-right
471 |6 |`>` |Greater than |Left-to-right
472 |6 |`>=` |Greater than or equal to |Left-to-right
473 |7 |`==` |Equal to |Left-to-right
474 |7 |`!=` |Not equal to |Left-to-right
475 |8 |`&&` |Logical AND |Left-to-right
476 |9 |`\|\|` |Logical OR |Left-to-right
479 Parentheses are supported to bypass the default order.
481 IMPORTANT: Unlike the C{nbsp}language, the bitwise AND and OR operators
482 (`&` and `|`) in 'EXPR' take precedence over relational operators (`<`,
483 `<=`, `>`, `>=`, `==`, and `!=`). This means the expression `2 & 2 == 2`
484 is _true_ while the equivalent C{nbsp}expression is _false_.
486 The arithmetic operators are :not: supported.
488 LTTng first casts all integer constants and fields to signed 64-bit
489 integers. The representation of negative integers is two's complement.
490 This means that, for example, the signed 8-bit integer field 0xff (-1)
491 becomes 0xffffffffffffffff (still -1) once casted.
493 Before a bitwise operator is applied, LTTng casts all its operands to
494 unsigned 64-bit integers, and then casts the result back to a signed
495 64-bit integer. For the bitwise NOT operator, it's the equivalent of
496 this C{nbsp}expression:
500 (int64_t) ~((uint64_t) val)
503 For the binary bitwise operators, it's the equivalent of those
508 (int64_t) ((uint64_t) lhs >> (uint64_t) rhs)
509 (int64_t) ((uint64_t) lhs << (uint64_t) rhs)
510 (int64_t) ((uint64_t) lhs & (uint64_t) rhs)
511 (int64_t) ((uint64_t) lhs ^ (uint64_t) rhs)
512 (int64_t) ((uint64_t) lhs | (uint64_t) rhs)
515 If the right-hand side of a bitwise shift operator (`<<` and `>>`) is
516 not in the [0,{nbsp}63] range, then 'EXPR' is _false_.
520 Use the man:lttng-track(1) and man:lttng-untrack(1) commands to allow or
521 disallow processes to record LTTng events based on their attributes
522 instead of using equivalent statically-known context fields in 'EXPR'
525 The former method is much more efficient.
530 ----------------------------
531 msg_id == 23 && size >= 2048
532 ----------------------------
534 -------------------------------------------------
535 $ctx.procname == "lttng*" && (!flag || poel < 34)
536 -------------------------------------------------
538 ---------------------------------------------------------
539 $app.my_provider:my_context == 17.34e9 || some_enum >= 14
540 ---------------------------------------------------------
542 ---------------------------------------
543 $ctx.cpu_id == 2 && filename != "*.log"
544 ---------------------------------------
546 ------------------------------------------------
547 eax_reg & 0xff7 == 0x240 && x[4] >> 12 <= 0x1234
548 ------------------------------------------------
554 When LTTng records an event{nbsp}__E__, the resulting event record has a
555 name which depends on the instrumentation point type condition (see the
556 ``<<inst-point-type-cond,Instrumentation point type condition>>''
557 section above) of the recording event rule which matched{nbsp}__E__:
559 LTTng tracepoint (option:--kernel/option:--userspace and option:--tracepoint options)::
560 Full name of the tracepoint from which LTTng creates{nbsp}__E__.
562 Note that the full name of a user space tracepoint is
563 __PROVIDER__++:++__NAME__, where __PROVIDER__ is the tracepoint provider
564 name and __NAME__ is the tracepoint name.
566 `java.util.logging` logging statement (option:--jul and option:--tracepoint options)::
569 Such an event record has a string field `logger_name` which contains the
570 name of the `java.util.logging` logger from which LTTng
573 Apache log4j logging statement (option:--log4j and option:--tracepoint options)::
576 Such an event record has a string field `logger_name` which contains the
577 name of the Apache log4j logger from which LTTng creates{nbsp}__E__.
579 Python logging statement (option:--python and option:--tracepoint options)::
582 Such an event record has a string field `logger_name` which contains the
583 name of the Python logger from which LTTng creates{nbsp}__E__.
585 Linux system call (option:--kernel and option:--syscall options)::
587 ++syscall_entry_++__NAME__, where _NAME_ is the name of the
588 system call from which LTTng creates{nbsp}__E__, without any
592 ++syscall_exit_++__NAME__, where _NAME_ is the name of the
593 system call from which LTTng creates{nbsp}__E__, without any
596 Linux kprobe (option:--kernel and option:--probe options)::
597 Linux user space probe (option:--kernel and option:--userspace-probe options)::
598 'RECORDNAME' (first non-option argument).
600 Linux kretprobe (option:--kernel and option:--function options)::
602 __RECORDNAME__++_entry++
605 __RECORDNAME__++_exit++
609 Enable a disabled recording event rule
610 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
611 The `enable-event` command can enable a disabled recording event rule,
612 as listed in the output of the man:lttng-list(1) command.
614 You may enable a disabled recording event rule regardless of the
615 activity (started or stopped) of its recording session (see
616 man:lttng-start(1) and man:lttng-stop(1)).
618 To enable a disabled recording event rule, run the `enable-event`
619 command with the exact same options and arguments that you used to
620 create it. In particular, with the option:--filter='EXPR' option, 'EXPR'
621 must be the exact same string as the one you used on creation.
624 include::common-lttng-cmd-options-head.txt[]
631 option:-j, option:--jul::
632 Create or enable recording event rules in the `java.util.logging`
633 (JUL) tracing domain.
635 option:-k, option:--kernel::
636 Create or enable recording event rules in the Linux kernel tracing
639 option:-l, option:--log4j::
640 Create or enable recording event rules in the Apache log4j tracing
643 option:-p, option:--python::
644 Create or enable recording event rules in the Python tracing domain.
646 option:-u, option:--userspace::
647 Create or enable recording event rules in the user space tracing
653 option:-c 'CHANNEL', option:--channel='CHANNEL'::
654 Create or enable recording event rules attached to the channel named
655 'CHANNEL' instead of `channel0`.
657 option:-s 'SESSION', option:--session='SESSION'::
658 Create or enable recording event rules in the recording session
659 named 'SESSION' instead of the current recording session.
662 Instrumentation point type condition
663 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
664 See the ``<<inst-point-type-cond,Instrumentation point type
665 condition>>'' section above.
669 option:--function='LOC'::
670 Only match Linux kretprobe events.
672 Only available with the option:--kernel option.
677 * A function address (`0x` hexadecimal prefix supported).
678 * A function symbol name.
679 * A function symbol name and an offset
680 (__SYMBOL__++pass:[+]++__OFFSET__ format).
683 You must specify the event record name with 'RECORDNAME'. See the
684 ``<<er-name,Event record name>>'' section above to learn more.
686 option:--probe='LOC'::
687 Only match Linux kprobe events.
689 Only available with the option:--kernel option.
694 * An address (`0x` hexadecimal prefix supported).
696 * A symbol name and an offset (__SYMBOL__++pass:[+]++__OFFSET__ format).
699 You must specify the event record name with 'RECORDNAME'. See the
700 ``<<er-name,Event record name>>'' section above to learn more.
702 option:--userspace-probe='LOC'::
703 Only match Linux user space probe events.
705 Only available with the option:--kernel option.
710 \[++elf:++]__PATH__++:++__SYMBOL__::
711 Probe an available symbol within a user space application or
716 Application or library path.
722 * The name of an application as found in the directories listed in the
723 `PATH` environment variable.
726 Symbol name of the function of which to instrument the entry.
728 'SYMBOL' can be any defined code symbol in the output of the man:nm(1)
729 command, including with its nloption:--dynamic option, which lists
733 As of LTTng{nbsp}{lttng_version}, not specifying `elf:` is equivalent to
734 specifying it, but this default may change in the future.
738 * `--userspace-probe=/usr/lib/libc.so.6:malloc`
739 * `--userspace-probe=./myapp:createUser`
740 * `--userspace-probe=elf:httpd:ap_run_open_htaccess`
742 ++sdt:++__PATH__++:++__PROVIDER__++:++__NAME__::
743 Use a SystemTap User-level Statically Defined Tracing (USDT) probe
744 within a user space application or library.
748 Application or library path.
754 * The name of an application as found in the directories listed in the
755 `PATH` environment variable.
759 USDT provider and probe names.
761 For example, with the following USDT probe:
765 DTRACE_PROBE2("server", "accept_request",
766 request_id, ip_addr);
769 The provider/probe name pair is `server:accept_request`.
772 Example: `--userspace-probe=sdt:./build/server:server:accept_request`
775 You must specify the event record name with 'RECORDNAME'. See the
776 ``<<er-name,Event record name>>'' section above to learn more.
779 Only match Linux system call events.
781 Only available with the option:--kernel option.
783 option:--tracepoint::
786 With the option:--kernel or option:--userspace option:::
787 LTTng tracepoint events.
788 With the option:--jul, option:--log4j, or option:--python option:::
791 With the option:--kernel, not specifying any of the instrumentation
792 point type options is equivalent to specifying the option:--tracepoint
793 option, but this default may change in the future.
795 With the option:--userspace, option:--jul, option:--log4j, and
796 option:--python options, not specifying the option:--tracepoint option
797 is equivalent to specifying it, but this default may change in the
803 See the ``<<event-name-cond,Event name condition>>'' section above.
805 option:-a, option:--all::
806 Equivalent to a single 'NAME' argument (LTTng tracepoint or logger
807 name) set to `*` (match anything).
809 You may :not: use this option with a 'NAME' argument.
811 option:-x 'XNAME'[,'XNAME']..., option:--exclude='XNAME'[,'XNAME']...::
812 Only match events of which none of the 'XNAME' arguments
813 matches the full name of the LTTng user space tracepoint.
815 Only available with the option:--userspace option.
817 'XNAME' is a globbing pattern: the `*` character means ``match
818 anything''. To match a literal `*` character, use :escwc:. To match
819 a literal `,` character, use :esccomma:.
822 Instrumentation point log level condition
823 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
824 See the ``<<inst-point-log-level-cond,Instrumentation point log level
825 condition>>'' section above.
829 option:--loglevel='LOGLEVEL'::
830 Only match events of which the log level of the LTTng tracepoint or
831 logging statement is at least as severe as 'LOGLEVEL'.
833 option:--loglevel-only='LOGLEVEL'::
834 Only match events of which the log level of the LTTng tracepoint or
835 logging statement is exactly 'LOGLEVEL'.
837 The instrumentation point log level options above are :not: available
838 with the option:--kernel option.
841 Event payload and context filter condition
842 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
843 See the ``<<filter-cond,Event payload and context filter condition>>''
846 option:-f 'EXPR', option:--filter='EXPR'::
847 Only match events of which 'EXPR', which can contain references to
848 event payload and current context fields, is _true_.
850 This option is only available with the option:--tracepoint or
851 option:--syscall option.
854 include::common-lttng-cmd-help-options.txt[]
857 include::common-lttng-cmd-after-options.txt[]
863 .Create a recording event rule which matches all Linux system call events (current recording session, default channel).
865 See the option:--all and option:--syscall options.
869 $ lttng enable-event --kernel --all --syscall
873 .Create a recording event rule which matches user space tracepoint events named specifically (current recording session, default channel).
875 The recording event rule below matches all user space tracepoint events
876 of which the name starts with `my_provider:msg`.
880 $ lttng enable-event --userspace 'my_provider:msg*'
884 .Create three recording event rules which match Python logging events named specifically (current recording session, default channel).
888 $ lttng enable-event --python server3,ui.window,user-mgmt
892 .Create a recording event rule which matches Apache log4j logging events with a specific log level range (current recording session, specific channel).
894 See the option:--channel, option:--all, and option:--loglevel options.
898 $ lttng enable-event --log4j --channel=my-loggers \
899 --all --loglevel=INFO
903 .Create a recording event rule which matches specific Linux kprobe events (current recording session, default channel).
905 The recording event rule below matches the entry of `usb_disconnect()`
906 Linux kernel function calls. The records of such events are named `usbd`
907 (see the ``<<er-name,Event record name>>'' section above).
909 See the option:--probe option.
913 $ lttng enable-event --kernel --probe=usb_disconnect usbd
917 .Create a recording event rule which matches Linux kernel tracepoint events which satisfy an event payload and context filter (specific recording session, default channel).
919 See the option:--session and option:--filter options.
923 $ lttng enable-event --kernel --session=my-session 'sched_*' \
924 --filter='$ctx.preemptible && comm != "systemd*"'
928 .Enable two Linux kernel tracepoint recording event rules (current recording session, specific channel).
930 See the option:--channel option.
934 $ lttng enable-event --kernel --channel=tva ja,wendy
939 include::common-footer.txt[]
945 man:lttng-disable-event(1),
946 man:lttng-enable-channel(1),
950 man:lttng-concepts(7)