For example, consider the following commands:
[role="term"]
-----------------------------------------------------------------
-lttng enable-event --userspace hello:world
-lttng enable-event --userspace hello:world --loglevel=TRACE_INFO
-----------------------------------------------------------------
+----
+$ lttng enable-event --userspace hello:world
+$ lttng enable-event --userspace hello:world --loglevel=TRACE_INFO
+----
Here, two event rules are created. The first one has a single condition:
the tracepoint name must match `hello:world`. The second one has two
(option:--probe or option:--function option's argument) which must
match event source's equivalent.
+
-Wildcard using the `*` character are supported _at the end_ of
-tracepoint and system call names.
+You can use `*` characters at any place in the tracepoint or system
+call name as wildcards to match zero or more characters. To use a
+literal `*` character, use :escwc:.
* Filter expression (option:--filter option) executed against the
dynamic values of event fields at execution time that must evaluate
- to true. See the <<filter-syntax,Filter expression syntax>> section
+ to true. See the <<filter-expr,Filter expression>> section
below for more information.
The available conditions for the application domains are:
* Tracepoint name ('EVENT' with option:--tracepoint option) which must
match event source's equivalent.
+
-Wildcard using the `*` character are supported _at the end_ of
-tracepoint names. When creating an event rule with a tracepoint name
-containing a wildcard, specific tracepoint names can be excluded from
-the match using the option:--exclude option.
+You can use `*` characters at any place in the tracepoint name as
+wildcards to match zero or more characters. To use a literal `*`
+character, use :escwc:. When you create an event rule with a tracepoint
+name containing a wildcard, you can exclude specific tracepoint names
+from the match with the option:--exclude option.
* Filter expression (option:--filter option) executed against the
dynamic values of event fields at execution time that must evaluate
- to true. See the <<filter-syntax,Filter expression syntax>> section
+ to true. See the <<filter-expr,Filter expression>> section
below for more information.
* Event's log level that must be at least as severe as a given
log level (option:--loglevel option) or match exactly a given log
argument named `*` (wildcard).
-[[filter-syntax]]
-Filter expression syntax
-~~~~~~~~~~~~~~~~~~~~~~~~
-Filter expressions can be specified with the option:--filter option
+[[filter-expr]]
+Filter expression
+~~~~~~~~~~~~~~~~~
+A filter expression can be specified with the option:--filter option
when creating a new event rule. If the filter expression evaluates
to true when executed against the dynamic values of an event's fields
when tracing, the filtering condition passes.
the command from a shell, as filter expressions typically include
characters having a special meaning for most shells.
-The filter expression syntax is very similar to C language conditional
-expressions (expressions that can be evaluated by an `if` statement).
-
-The following logical operators are supported:
-
-[width="40%",options="header"]
-|=====================================
-| Name | Syntax
-| Logical negation (NOT) | `!a`
-| Logical conjunction (AND) | `a && b`
-| Logical disjunction (OR) | `a \|\| b`
-|=====================================
-
-The following comparison operators/relational operators are supported:
+The filter expression syntax is similar to C language conditional
+expressions (expressions that can be evaluated by an `if` statement),
+albeit with a few differences:
-[width="40%",options="header"]
-|====================================
-| Name | Syntax
-| Equal to | `a == b`
-| Not equal to | `a != b`
-| Greater than | `a > b`
-| Less than | `a < b`
-| Greater than or equal to | `a >= b`
-| Less than or equal to | `a <= b`
-|====================================
-
-The arithmetic and bitwise operators are :not: supported.
-
-The precedence table of the operators above is the same as the one of
-the C language. Parentheses are supported to bypass this.
+* C integer and floating point number constants are supported, as well
+ as literal strings between double quotes (`"`). You can use `*`
+ characters at any place in a literal string as wildcards to match zero
+ or more characters. To use a literal `*` character, use :escwc:.
++
+Examples: `32`, `-0x17`, `0755`, `12.34`,
++"a :escbs:"literal string:escbs:""+, `"src/*/*.h"`.
-The dynamic value of an event field is read by using its name as
-a C identifier.
+* The dynamic value of an event field is read by using its name as a C
+ identifier.
++
+The dot and square bracket notations are available, like in the C
+language, to access nested structure and array/sequence fields.
+Only a constant, positive integer number can be used within square
+brackets. If the index is out of bounds, the whole filter expression
+evaluates to false (the event is discarded).
++
+An enumeration field's value is an integer.
++
+When the expression's field does not exist, the whole filter expression
+evaluates to false.
++
+Examples: `my_field`, `target_cpu`, `seq[7]`, `msg.user[1].data[2][17]`.
-The dynamic value of a statically-known context field is read by
-prefixing its name with `$ctx.`. Statically-known context fields are
-context fields added to channels without the `$app.` prefix using the
-man:lttng-add-context(1) command.
+* The dynamic value of a statically-known context field is read by
+ prefixing its name with `$ctx.`. Statically-known context fields are
+ context fields added to channels without the `$app.` prefix using the
+ man:lttng-add-context(1) command.
++
+When the expression's statically-known context field does not exist,
+the whole filter expression evaluates to false.
++
+Examples: `$ctx.prio`, `$ctx.preemptible`,
+`$ctx.perf:cpu:stalled-cycles-frontend`.
-The dynamic value of an application-specific context field is read by
-prefixing its name with `$app.` (follows the format used to add such a
-context field with the man:lttng-add-context(1) command).
+* The dynamic value of an application-specific context field is read by
+ prefixing its name with `$app.` (follows the format used to add such a
+ context field with the man:lttng-add-context(1) command).
++
+When the expression's application-specific context field does not exist,
+the whole filter expression evaluates to false.
++
+Example: `$app.server:cur_user`.
+
+The following precedence table shows the operators which are supported
+in a filter expression. In this table, the highest precedence is 1.
+Parentheses are supported to bypass the default order.
+
+IMPORTANT: Unlike the C language, the `lttng enable-event` filter
+expression syntax's bitwise AND and OR operators (`&` and `|`) take
+precedence over relational operators (`<`, `<=`, `>`, `>=`, `==`, and
+`!=`). This means the filter expression `2 & 2 == 2` is true while the
+equivalent C expression is false.
+
+[options="header"]
+|===
+|Precedence |Operator |Description |Associativity
+|1 |`-` |Unary minus |Right-to-left
+|1 |`+` |Unary plus |Right-to-left
+|1 |`!` |Logical NOT |Right-to-left
+|1 |`~` |Bitwise NOT |Right-to-left
+|2 |`<<` |Bitwise left shift |Left-to-right
+|2 |`>>` |Bitwise right shift |Left-to-right
+|3 |`&` |Bitwise AND |Left-to-right
+|4 |`^` |Bitwise XOR |Left-to-right
+|5 |`\|` |Bitwise OR |Left-to-right
+|6 |`<` |Less than |Left-to-right
+|6 |`<=` |Less than or equal to |Left-to-right
+|6 |`>` |Greater than |Left-to-right
+|6 |`>=` |Greater than or equal to |Left-to-right
+|7 |`==` |Equal to |Left-to-right
+|7 |`!=` |Not equal to |Left-to-right
+|8 |`&&` |Logical AND |Left-to-right
+|9 |`\|\|` |Logical OR |Left-to-right
+|===
+
+The arithmetic operators are :not: supported.
+
+All integer constants and fields are first casted to signed 64-bit
+integers. The representation of negative integers is two's complement.
+This means that, for example, the signed 8-bit integer field 0xff (-1)
+becomes 0xffffffffffffffff (still -1) once casted.
+
+Before a bitwise operator is applied, all its operands are casted to
+unsigned 64-bit integers, and the result is casted back to a signed
+64-bit integer. For the bitwise NOT operator, it is the equivalent of
+this C expression:
+
+[source,c]
+----
+(int64_t) ~((uint64_t) val)
+----
-When a comparison includes a non existent event field, the whole filter
-expression evaluates to false (the event is discarded).
+For the binary bitwise operators, it is the equivalent of those C
+expressions:
-C integer and floating point number constants are supported, as well as
-literal strings between double quotes (`"`). Literal strings can contain
-a wildcard character (`*`) at the end to match more than one string.
-This wildcard can be escaped using :escwc:.
+[source,c]
+----
+(int64_t) ((uint64_t) lhs >> (uint64_t) rhs)
+(int64_t) ((uint64_t) lhs << (uint64_t) rhs)
+(int64_t) ((uint64_t) lhs & (uint64_t) rhs)
+(int64_t) ((uint64_t) lhs ^ (uint64_t) rhs)
+(int64_t) ((uint64_t) lhs | (uint64_t) rhs)
+----
-LTTng-UST enumeration fields can be compared to integer values (fields
-or constants).
+If the right-hand side of a bitwise shift operator (`<<` and `>>`) is
+not in the [0,{nbsp}63] range, the whole filter expression evaluates to
+false.
NOTE: Although it is possible to filter the process ID of an event when
the `pid` context has been added to its channel using, for example,
`$ctx.pid == 2832`, it is recommended to use the PID tracker instead,
which is much more efficient (see man:lttng-track(1)).
-Examples:
+Filter expression examples:
----------------------------
msg_id == 23 && size >= 2048
$app.my_provider:my_context == 17.34e9 || some_enum >= 14
---------------------------------------------------------
+---------------------------------------
+$ctx.cpu_id == 2 && filename != "*.log"
+---------------------------------------
+
+------------------------------------------------
+eax_reg & 0xff7 == 0x240 && x[4] >> 12 <= 0x1234
+------------------------------------------------
+
[[log-levels]]
Log levels
Target
~~~~~~
-option:-c, option:--channel='CHANNEL'::
+option:-c 'CHANNEL', option:--channel='CHANNEL'::
Create or enable event rules in the channel named 'CHANNEL' instead
of the default channel name `channel0`.
-option:-s, option:--session='SESSION'::
+option:-s 'SESSION', option:--session='SESSION'::
Create or enable event rules in the tracing session named 'SESSION'
instead of the current tracing session.
Filtering and exclusion
~~~~~~~~~~~~~~~~~~~~~~~
-option:-x, option:--exclude='EVENT'[,'EVENT']...::
+option:-x 'EVENT'[,'EVENT']..., option:--exclude='EVENT'[,'EVENT']...::
Exclude events named 'EVENT' from the event rule. This option
- can be used when the command's 'EVENT' argument contains a wildcard
- (`*`) to exclude specific names. Only available with application
- domains.
+ can be used when the command's 'EVENT' argument contains at least
+ one wildcard star (`*`) to exclude specific names. 'EVENT' can also
+ contain wildcard stars. To use a
+ literal `,` character, use :esccomma:.
+ Only available with the option:--userspace domain.
-option:-f, option:--filter='EXPR'::
+option:-f 'EXPR', option:--filter='EXPR'::
Add filter expression condition to the event rule. Expression 'EXPR'
must evaluate to true when executed against the dynamic values of
- event fields. See the <<filter-syntax,Filter expression syntax>>
+ event fields. See the <<filter-expr,Filter expression>>
section above for more information.