One Hat Cyber Team

Edit File: trace-cmd.dat.v7.5.html

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
    "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
<meta name="generator" content="AsciiDoc 10.2.0" />
<title>TRACE-CMD.DAT.v7(5)</title>
<style type="text/css">
/* Shared CSS for AsciiDoc xhtml11 and html5 backends */

/* Default font. */
body {
  font-family: Georgia,serif;
}

/* Title font. */
h1, h2, h3, h4, h5, h6,
div.title, caption.title,
thead, p.table.header,
#toctitle,
#author, #revnumber, #revdate, #revremark,
#footer {
  font-family: Arial,Helvetica,sans-serif;
}

body {
  margin: 1em 5% 1em 5%;
}

a {
  color: blue;
  text-decoration: underline;
}
a:visited {
  color: fuchsia;
}

em {
  font-style: italic;
  color: navy;
}

strong {
  font-weight: bold;
  color: #083194;
}

h1, h2, h3, h4, h5, h6 {
  color: #527bbd;
  margin-top: 1.2em;
  margin-bottom: 0.5em;
  line-height: 1.3;
}

h1, h2, h3 {
  border-bottom: 2px solid silver;
}
h2 {
  padding-top: 0.5em;
}
h3 {
  float: left;
}
h3 + * {
  clear: left;
}
h5 {
  font-size: 1.0em;
}

div.sectionbody {
  margin-left: 0;
}

hr {
  border: 1px solid silver;
}

p {
  margin-top: 0.5em;
  margin-bottom: 0.5em;
}

ul, ol, li > p {
  margin-top: 0;
}
ul > li     { color: #aaa; }
ul > li > * { color: black; }

.monospaced, code, pre {
  font-family: "Courier New", Courier, monospace;
  font-size: inherit;
  color: navy;
  padding: 0;
  margin: 0;
}
pre {
  white-space: pre-wrap;
}

#author {
  color: #527bbd;
  font-weight: bold;
  font-size: 1.1em;
}
#email {
}
#revnumber, #revdate, #revremark {
}

#footer {
  font-size: small;
  border-top: 2px solid silver;
  padding-top: 0.5em;
  margin-top: 4.0em;
}
#footer-text {
  float: left;
  padding-bottom: 0.5em;
}
#footer-badges {
  float: right;
  padding-bottom: 0.5em;
}

#preamble {
  margin-top: 1.5em;
  margin-bottom: 1.5em;
}
div.imageblock, div.exampleblock, div.verseblock,
div.quoteblock, div.literalblock, div.listingblock, div.sidebarblock,
div.admonitionblock {
  margin-top: 1.0em;
  margin-bottom: 1.5em;
}
div.admonitionblock {
  margin-top: 2.0em;
  margin-bottom: 2.0em;
  margin-right: 10%;
  color: #606060;
}

div.content { /* Block element content. */
  padding: 0;
}

/* Block element titles. */
div.title, caption.title {
  color: #527bbd;
  font-weight: bold;
  text-align: left;
  margin-top: 1.0em;
  margin-bottom: 0.5em;
}
div.title + * {
  margin-top: 0;
}

td div.title:first-child {
  margin-top: 0.0em;
}
div.content div.title:first-child {
  margin-top: 0.0em;
}
div.content + div.title {
  margin-top: 0.0em;
}

div.sidebarblock > div.content {
  background: #ffffee;
  border: 1px solid #dddddd;
  border-left: 4px solid #f0f0f0;
  padding: 0.5em;
}

div.listingblock > div.content {
  border: 1px solid #dddddd;
  border-left: 5px solid #f0f0f0;
  background: #f8f8f8;
  padding: 0.5em;
}

div.quoteblock, div.verseblock {
  padding-left: 1.0em;
  margin-left: 1.0em;
  margin-right: 10%;
  border-left: 5px solid #f0f0f0;
  color: #888;
}

div.quoteblock > div.attribution {
  padding-top: 0.5em;
  text-align: right;
}

div.verseblock > pre.content {
  font-family: inherit;
  font-size: inherit;
}
div.verseblock > div.attribution {
  padding-top: 0.75em;
  text-align: left;
}
/* DEPRECATED: Pre version 8.2.7 verse style literal block. */
div.verseblock + div.attribution {
  text-align: left;
}

div.admonitionblock .icon {
  vertical-align: top;
  font-size: 1.1em;
  font-weight: bold;
  text-decoration: underline;
  color: #527bbd;
  padding-right: 0.5em;
}
div.admonitionblock td.content {
  padding-left: 0.5em;
  border-left: 3px solid #dddddd;
}

div.exampleblock > div.content {
  border-left: 3px solid #dddddd;
  padding-left: 0.5em;
}

div.imageblock div.content { padding-left: 0; }
span.image img { border-style: none; vertical-align: text-bottom; }
a.image:visited { color: white; }

dl {
  margin-top: 0.8em;
  margin-bottom: 0.8em;
}
dt {
  margin-top: 0.5em;
  margin-bottom: 0;
  font-style: normal;
  color: navy;
}
dd > *:first-child {
  margin-top: 0.1em;
}

ul, ol {
    list-style-position: outside;
}
ol.arabic {
  list-style-type: decimal;
}
ol.loweralpha {
  list-style-type: lower-alpha;
}
ol.upperalpha {
  list-style-type: upper-alpha;
}
ol.lowerroman {
  list-style-type: lower-roman;
}
ol.upperroman {
  list-style-type: upper-roman;
}

div.compact ul, div.compact ol,
div.compact p, div.compact p,
div.compact div, div.compact div {
  margin-top: 0.1em;
  margin-bottom: 0.1em;
}

tfoot {
  font-weight: bold;
}
td > div.verse {
  white-space: pre;
}

div.hdlist {
  margin-top: 0.8em;
  margin-bottom: 0.8em;
}
div.hdlist tr {
  padding-bottom: 15px;
}
dt.hdlist1.strong, td.hdlist1.strong {
  font-weight: bold;
}
td.hdlist1 {
  vertical-align: top;
  font-style: normal;
  padding-right: 0.8em;
  color: navy;
}
td.hdlist2 {
  vertical-align: top;
}
div.hdlist.compact tr {
  margin: 0;
  padding-bottom: 0;
}

.comment {
  background: yellow;
}

.footnote, .footnoteref {
  font-size: 0.8em;
}

span.footnote, span.footnoteref {
  vertical-align: super;
}

#footnotes {
  margin: 20px 0 20px 0;
  padding: 7px 0 0 0;
}

#footnotes div.footnote {
  margin: 0 0 5px 0;
}

#footnotes hr {
  border: none;
  border-top: 1px solid silver;
  height: 1px;
  text-align: left;
  margin-left: 0;
  width: 20%;
  min-width: 100px;
}

div.colist td {
  padding-right: 0.5em;
  padding-bottom: 0.3em;
  vertical-align: top;
}
div.colist td img {
  margin-top: 0.3em;
}

@media print {
  #footer-badges { display: none; }
}

#toc {
  margin-bottom: 2.5em;
}

#toctitle {
  color: #527bbd;
  font-size: 1.1em;
  font-weight: bold;
  margin-top: 1.0em;
  margin-bottom: 0.1em;
}

div.toclevel0, div.toclevel1, div.toclevel2, div.toclevel3, div.toclevel4 {
  margin-top: 0;
  margin-bottom: 0;
}
div.toclevel2 {
  margin-left: 2em;
  font-size: 0.9em;
}
div.toclevel3 {
  margin-left: 4em;
  font-size: 0.9em;
}
div.toclevel4 {
  margin-left: 6em;
  font-size: 0.9em;
}

span.aqua { color: aqua; }
span.black { color: black; }
span.blue { color: blue; }
span.fuchsia { color: fuchsia; }
span.gray { color: gray; }
span.green { color: green; }
span.lime { color: lime; }
span.maroon { color: maroon; }
span.navy { color: navy; }
span.olive { color: olive; }
span.purple { color: purple; }
span.red { color: red; }
span.silver { color: silver; }
span.teal { color: teal; }
span.white { color: white; }
span.yellow { color: yellow; }

span.aqua-background { background: aqua; }
span.black-background { background: black; }
span.blue-background { background: blue; }
span.fuchsia-background { background: fuchsia; }
span.gray-background { background: gray; }
span.green-background { background: green; }
span.lime-background { background: lime; }
span.maroon-background { background: maroon; }
span.navy-background { background: navy; }
span.olive-background { background: olive; }
span.purple-background { background: purple; }
span.red-background { background: red; }
span.silver-background { background: silver; }
span.teal-background { background: teal; }
span.white-background { background: white; }
span.yellow-background { background: yellow; }

span.big { font-size: 2em; }
span.small { font-size: 0.6em; }

span.underline { text-decoration: underline; }
span.overline { text-decoration: overline; }
span.line-through { text-decoration: line-through; }

div.unbreakable { page-break-inside: avoid; }

/*
 * xhtml11 specific
 *
 * */

div.tableblock {
  margin-top: 1.0em;
  margin-bottom: 1.5em;
}
div.tableblock > table {
  border: 3px solid #527bbd;
}
thead, p.table.header {
  font-weight: bold;
  color: #527bbd;
}
p.table {
  margin-top: 0;
}
/* Because the table frame attribute is overridden by CSS in most browsers. */
div.tableblock > table[frame="void"] {
  border-style: none;
}
div.tableblock > table[frame="hsides"] {
  border-left-style: none;
  border-right-style: none;
}
div.tableblock > table[frame="vsides"] {
  border-top-style: none;
  border-bottom-style: none;
}

/*
 * html5 specific
 *
 * */

table.tableblock {
  margin-top: 1.0em;
  margin-bottom: 1.5em;
}
thead, p.tableblock.header {
  font-weight: bold;
  color: #527bbd;
}
p.tableblock {
  margin-top: 0;
}
table.tableblock {
  border-width: 3px;
  border-spacing: 0px;
  border-style: solid;
  border-color: #527bbd;
  border-collapse: collapse;
}
th.tableblock, td.tableblock {
  border-width: 1px;
  padding: 4px;
  border-style: solid;
  border-color: #527bbd;
}

table.tableblock.frame-topbot {
  border-left-style: hidden;
  border-right-style: hidden;
}
table.tableblock.frame-sides {
  border-top-style: hidden;
  border-bottom-style: hidden;
}
table.tableblock.frame-none {
  border-style: hidden;
}

th.tableblock.halign-left, td.tableblock.halign-left {
  text-align: left;
}
th.tableblock.halign-center, td.tableblock.halign-center {
  text-align: center;
}
th.tableblock.halign-right, td.tableblock.halign-right {
  text-align: right;
}

th.tableblock.valign-top, td.tableblock.valign-top {
  vertical-align: top;
}
th.tableblock.valign-middle, td.tableblock.valign-middle {
  vertical-align: middle;
}
th.tableblock.valign-bottom, td.tableblock.valign-bottom {
  vertical-align: bottom;
}

/*
 * manpage specific
 *
 * */

body.manpage h1 {
  padding-top: 0.5em;
  padding-bottom: 0.5em;
  border-top: 2px solid silver;
  border-bottom: 2px solid silver;
}
body.manpage h2 {
  border-style: none;
}
body.manpage div.sectionbody {
  margin-left: 3em;
}

@media print {
  body.manpage div#toc { display: none; }
}

</style>
<script type="text/javascript">
/*<![CDATA[*/
var asciidoc = {  // Namespace.

/////////////////////////////////////////////////////////////////////
// Table Of Contents generator
/////////////////////////////////////////////////////////////////////

/* Author: Mihai Bazon, September 2002
 * http://students.infoiasi.ro/~mishoo
 *
 * Table Of Content generator
 * Version: 0.4
 *
 * Feel free to use this script under the terms of the GNU General Public
 * License, as long as you do not remove or alter this notice.
 */

/* modified by Troy D. Hanson, September 2006. License: GPL */
 /* modified by Stuart Rackham, 2006, 2009. License: GPL */

// toclevels = 1..4.
toc: function (toclevels) {

function getText(el) {
    var text = "";
    for (var i = el.firstChild; i != null; i = i.nextSibling) {
      if (i.nodeType == 3 /* Node.TEXT_NODE */) // IE doesn't speak constants.
        text += i.data;
      else if (i.firstChild != null)
        text += getText(i);
    }
    return text;
  }

function TocEntry(el, text, toclevel) {
    this.element = el;
    this.text = text;
    this.toclevel = toclevel;
  }

var toc = document.getElementById("toc");
  if (!toc) {
    return;
  }

// Delete existing TOC entries in case we're reloading the TOC.
  var tocEntriesToRemove = [];
  var i;
  for (i = 0; i < toc.childNodes.length; i++) {
    var entry = toc.childNodes[i];
    if (entry.nodeName.toLowerCase() == 'div'
     && entry.getAttribute("class")
     && entry.getAttribute("class").match(/^toclevel/))
      tocEntriesToRemove.push(entry);
  }
  for (i = 0; i < tocEntriesToRemove.length; i++) {
    toc.removeChild(tocEntriesToRemove[i]);
  }

// Rebuild TOC entries.
  var entries = tocEntries(document.getElementById("content"), toclevels);
  for (var i = 0; i < entries.length; ++i) {
    var entry = entries[i];
    if (entry.element.id == "")
      entry.element.id = "_toc_" + i;
    var a = document.createElement("a");
    a.href = "#" + entry.element.id;
    a.appendChild(document.createTextNode(entry.text));
    var div = document.createElement("div");
    div.appendChild(a);
    div.className = "toclevel" + entry.toclevel;
    toc.appendChild(div);
  }
  if (entries.length == 0)
    toc.parentNode.removeChild(toc);
},

/////////////////////////////////////////////////////////////////////
// Footnotes generator
/////////////////////////////////////////////////////////////////////

/* Based on footnote generation code from:
 * http://www.brandspankingnew.net/archive/2005/07/format_footnote.html
 */

footnotes: function () {
  // Delete existing footnote entries in case we're reloading the footnodes.
  var i;
  var noteholder = document.getElementById("footnotes");
  if (!noteholder) {
    return;
  }
  var entriesToRemove = [];
  for (i = 0; i < noteholder.childNodes.length; i++) {
    var entry = noteholder.childNodes[i];
    if (entry.nodeName.toLowerCase() == 'div' && entry.getAttribute("class") == "footnote")
      entriesToRemove.push(entry);
  }
  for (i = 0; i < entriesToRemove.length; i++) {
    noteholder.removeChild(entriesToRemove[i]);
  }

// Rebuild footnote entries.
  var cont = document.getElementById("content");
  var spans = cont.getElementsByTagName("span");
  var refs = {};
  var n = 0;
  for (i=0; i<spans.length; i++) {
    if (spans[i].className == "footnote") {
      n++;
      var note = spans[i].getAttribute("data-note");
      if (!note) {
        // Use [\s\S] in place of . so multi-line matches work.
        // Because JavaScript has no s (dotall) regex flag.
        note = spans[i].innerHTML.match(/\s*\[([\s\S]*)]\s*/)[1];
        spans[i].innerHTML =
          "[<a id='_footnoteref_" + n + "' href='#_footnote_" + n +
          "' title='View footnote' class='footnote'>" + n + "</a>]";
        spans[i].setAttribute("data-note", note);
      }
      noteholder.innerHTML +=
        "<div class='footnote' id='_footnote_" + n + "'>" +
        "<a href='#_footnoteref_" + n + "' title='Return to text'>" +
        n + "</a>. " + note + "</div>";
      var id =spans[i].getAttribute("id");
      if (id != null) refs["#"+id] = n;
    }
  }
  if (n == 0)
    noteholder.parentNode.removeChild(noteholder);
  else {
    // Process footnoterefs.
    for (i=0; i<spans.length; i++) {
      if (spans[i].className == "footnoteref") {
        var href = spans[i].getElementsByTagName("a")[0].getAttribute("href");
        href = href.match(/#.*/)[0];  // Because IE return full URL.
        n = refs[href];
        spans[i].innerHTML =
          "[<a href='#_footnote_" + n +
          "' title='View footnote' class='footnote'>" + n + "</a>]";
      }
    }
  }
},

install: function(toclevels) {
  var timerId;

function reinstall() {
    asciidoc.footnotes();
    if (toclevels) {
      asciidoc.toc(toclevels);
    }
  }

function reinstallAndRemoveTimer() {
    clearInterval(timerId);
    reinstall();
  }

timerId = setInterval(reinstall, 500);
  if (document.addEventListener)
    document.addEventListener("DOMContentLoaded", reinstallAndRemoveTimer, false);
  else
    window.onload = reinstallAndRemoveTimer;
}

}
asciidoc.install();
/*]]>*/
</script>
</head>
<body class="manpage">
<div id="header">
<h1>
TRACE-CMD.DAT.v7(5) Manual Page
</h1>
<h2>NAME</h2>
<div class="sectionbody">
<p>trace-cmd.dat.v7 -
   trace-cmd version 7 file format
</p>
</div>
</div>
<div id="content">
<div class="sect1">
<h2 id="_synopsis">SYNOPSIS</h2>
<div class="sectionbody">
<div class="paragraph"><p><strong>trace-cmd.dat</strong> ignore</p></div>
</div>
</div>
<div class="sect1">
<h2 id="_description">DESCRIPTION</h2>
<div class="sectionbody">
<div class="paragraph"><p>The trace-cmd(1) utility produces a "trace.dat" file. The file may also
be named anything depending if the user specifies a different output name,
but it must have a certain binary format. The file is used
by trace-cmd to save kernel traces into it and be able to extract
the trace from it at a later point (see <strong>trace-cmd-report(1)</strong>).</p></div>
</div>
</div>
<div class="sect1">
<h2 id="_initial_format">INITIAL FORMAT</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>The first three bytes contain the magic value:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>0x17 0x08  0x44</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 7 bytes contain the characters:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>"tracing"</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next set of characters contain a null '\0' terminated string
that contains the version of the file:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>"7\0"</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 1 byte contains the flags for the file endianess:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>0 = little endian
1 = big endian</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next byte contains the number of bytes per "long" value:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>4 - 32-bit long values
8 - 64-bit long values</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>Note: This is the long size of the target's user space. Not the
kernel space size.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>[ Now all numbers are written in file defined endianess. ]</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 4 bytes are a 32-bit word that defines what the traced
host machine page size was.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The compression algorithm header is written next:
   "name\0version\0"
where "name" and "version" are strings, name and version of the
compression algorithm used to compress the trace file. If the name
is "none", the data in the file is not compressed.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 8 bytes are 64-bit integer, the offset within the file where
the first OPTIONS section is located.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The rest of the file consists of different sections. The only mandatory
is the first OPTIONS section, all others are optional. The location and
the order of the sections is not strict. Each section starts with a header:</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_format_of_the_section_header">FORMAT OF THE SECTION HEADER</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>&lt;2 bytes&gt; unsigned short integer, ID of the section.
&lt;2 bytes&gt; unsigned short integer, section flags:
  1 = the section is compressed.
&lt;4 bytes&gt; ID of a string, description of the section.
&lt;8 bytes&gt; long long unsigned integer, size of the section in the file.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>If the section is compressed, the above is the compressed size.
The section must be uncompressed on reading. The described format of
the sections refers to the uncompressed data.</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_compression_format_of_the_file_sections">COMPRESSION FORMAT OF THE FILE SECTIONS</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>Some of the sections in the file may be compressed with the compression algorithm,
specified in the compression algorithm header. Compressed sections have a compression
header, written after the section header and right before the compressed data:
  &lt;4 bytes&gt; unsigned int, size of compressed data in this section.
  &lt;4 bytes&gt; unsigned int, size of uncompressed data.
  &lt;data&gt; binary compressed data, with the specified size.</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_compression_format_of_the_trace_data">COMPRESSION FORMAT OF THE TRACE DATA</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>There are two special sections, BUFFER FLYRECORD and BUFFER LATENCY, containing
trace data. These sections may be compressed with the compression algorithm, specified
in the compression header. Usually the size of these sections is huge, that's why its
compression format is different from the other sections. The trace data is compressed
in chunks The size of one chunk is specified in the file creation time. The format
of compressed trace data is:
   &lt;4 bytes&gt; unsigned int, count of chunks.
   Follows the compressed chunks of given count. For each chunk:
      &lt;4 bytes&gt; unsigned int, size of compressed data in this chunk.
      &lt;4 bytes&gt; unsigned int, size of uncompressed data, aligned with the trace page size.
      &lt;data&gt; binary compressed data, with the specified size.
These chunks must be uncompressed on reading. The described format of
trace data refers to the uncompressed data.</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_options_section">OPTIONS SECTION</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>Section ID: 0</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>This is the the only mandatory section in the file. There can be multiple
options sections, the first one is located at the offset specified right
after the compression algorithm header. The section consists of multiple
trace options, each option has the following format:
  &lt;2 bytes&gt; unsigned short integer, ID of the option.
  &lt;4 bytes&gt; unsigned integer, size of the option's data.
  &lt;binary data&gt; bytes of the size specified above, data of the option.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>Options, supported by the trace file version 7:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>DONE: id 0, size 8
  This option indicates the end of the options section, it is written
  always as last option. The DONE option data is:
     &lt;8 bytes&gt; long long unsigned integer, offset in the trace file where
     the next options section is located. If this offset is 0, then there
     are no more options sections.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>DATE: id 1, size vary
  The DATE option data is a null terminated ASCII string, which represents
  the time difference between trace events timestamps and the Generic Time
  of Day of the system.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>CPUSTAT: id 2, size vary
  The CPUSTAT option data is a null terminated ASCII string, the content of the
  "per_cpu/cpu&lt;id&gt;/stats" file from the trace directory. There is a CPUSTAT option
  for each CPU.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>BUFFER: id 3, size vary
  The BUFFER option describes the flyrecord trace data saved in the file, collected
  from one trace instance. There is BUFFER option for each trace instance. The format
  of the BUFFER data is:
    &lt;8 bytes&gt; long long unsigned integer, offset in the trace file where the
    BUFFER FLYRECORD section is located, containing flyrecord trace data.
    &lt;string&gt; a null terminated ASCII string, name of the trace instance. Empty string ""
    is saved as name of the top instance.
    &lt;string&gt; a null terminated ASCII string, trace clock used for events timestamps in
    this trace instance.
    &lt;4 bytes&gt; unsigned integer, size of the trace buffer page.
    &lt;4 bytes&gt; unsigned integer, count of the CPUs with trace data.
    For each CPU of the above count:
       &lt;4 bytes&gt; unsigned integer, ID of the CPU.
       &lt;8 bytes&gt; long long unsigned integer, offset in the trace file where the trace data
       for this CPU is located.
       &lt;8 bytes&gt; long long unsigned integer, size of the trace data for this CPU.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>TRACECLOCK: id 4, size vary
  The TRACECLOCK option data is a null terminated ASCII string, the content of the
  "trace_clock" file from the trace directory.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>UNAME: id 5, size vary
  The UNAME option data is a null terminated ASCII string, identifying the system where
  the trace data is collected. The string is retrieved by the uname() system call.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>HOOK: id 6, size vary
  The HOOK option data is a null terminated ASCII string, describing event hooks: custom
  event matching to connect any two events together.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>OFFSET: id 7, size vary
  The OFFSET option data is a null terminated ASCII string, representing a fixed time that
  is added to each event timestamp on reading.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>CPUCOUNT: id 8, size 4
  The CPUCOUNT option data is:
    &lt;4 bytes&gt; unsigned integer, number of CPUs in the system.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>VERSION: id 9, size vary
  The VERSION option data is a null terminated ASCII string, representing the version of
  the trace-cmd application, used to collect these trace logs.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>PROCMAPS: id 10, size vary
  The PROCMAPS option data is a null terminated ASCII string, representing the memory map
  of each traced filtered process. The format of the string is, for each filtered process:
    &lt;procss ID&gt; &lt;libraries count&gt; &lt;process command&gt; \n
      &lt;memory start address&gt; &lt;memory end address&gt; &lt;full path of the mapped library file&gt; \n
      ...
       separate line for each library, used by this process
      ...
    ...</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>TRACEID: id 11, size 8
  The TRACEID option data is a unique identifier of this tracing session:
    &lt;8 bytes&gt; long long unsigned integer, trace session identifier.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>TIME_SHIFT: id 12, size vary
  The TIME_SHIFT option stores time synchronization information, collected during host and guest
  tracing session. Usually it is saved in the guest trace file. This information is used to
  synchronize guest with host events timestamps, when displaying all files from this tracing
  session. The format of the TIME_SHIFT option data is:
    &lt;8 bytes&gt; long long unsigned integer, trace identifier of the peer (usually the host).
    &lt;4 bytes&gt; unsigned integer, flags specific to the time synchronization protocol, used in this
    trace session.
    &lt;4 bytes&gt; unsigned integer, number of traced CPUs. For each CPU, timestamps corrections
    are recorded:
       &lt;4 bytes&gt; unsigned integer, count of the recorded timestamps corrections for this CPU.
       &lt;array of unsigned long long integers of the above count&gt;, times when the corrections are calculated
       &lt;array of unsigned long long integers of the above count&gt;, corrections offsets
       &lt;array of unsigned long long integers of the above count&gt;, corrections scaling ratio</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>GUEST: id 13, size vary
  The GUEST option stores information about traced guests in this tracing session. Usually it is
  saved in the host trace file. There is a separate GUEST option for each traced guest.
  The information is used when displaying all files from this tracing session. The format of
  the GUEST option data is:
     &lt;string&gt; a null terminated ASCII string, name of the guest.
     &lt;8 bytes&gt; long long unsigned integer, trace identifier of the guest for this session.
     &lt;4 bytes&gt; unsigned integer, number of guest's CPUs. For each CPU:
        &lt;4 bytes&gt; unsigned integer, ID of the CPU.
        &lt;4 bytes&gt; unsigned integer, PID of the host task, emulating this guest CPU.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>TSC2NSEC: id 14, size 16
  The TSC2NSEC option stores information, used to convert TSC events timestamps to nanoseconds.
  The format of the TSC2NSEC option data is:
     &lt;4 bytes&gt; unsigned integer, time multiplier.
     &lt;4 bytes&gt; unsigned integer, time shift.
     &lt;8 bytes&gt; unsigned long long integer, time offset.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>STRINGS: id 15, size vary
  The STRINGS option holds a list of nul terminated strings that holds the names of the
  other sections.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>HEADER_INFO: id 16, size 8
  The HEADER_INFO option data is:
    &lt;8 bytes&gt; long long unsigned integer, offset into the trace file where the HEADER INFO
    section is located</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>FTRACE_EVENTS: id 17, size 8
  The FTRACE_EVENTS option data is:
    &lt;8 bytes&gt; long long unsigned integer, offset into the trace file where the
    FTRACE EVENT FORMATS section is located.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>EVENT_FORMATS: id 18, size 8
  The EVENT_FORMATS option data is:
    &lt;8 bytes&gt; long long unsigned integer, offset into the trace file where the EVENT FORMATS
    section is located.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>KALLSYMS: id 19, size 8
  The KALLSYMS option data is:
    &lt;8 bytes&gt; long long unsigned integer, offset into the trace file where the KALLSYMS
    section is located.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>PRINTK: id 20, size 8
  The PRINTK option data is:
    &lt;8 bytes&gt; long long unsigned integer, offset into the trace file where the TRACE_PRINTK
    section is located.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>CMDLINES: id 21, size 8
  The CMDLINES option data is:
    &lt;8 bytes&gt; long long unsigned integer, offset into the trace file where the
    SAVED COMMAND LINES section is located.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>BUFFER_TEXT: id 22, size
  The BUFFER_LAT option describes the latency trace data saved in the file. The format
  of the BUFFER_LAT data is:
    &lt;8 bytes&gt; long long unsigned integer, offset in the trace file where the
    BUFFER LATENCY section is located, containing latency trace data.
    &lt;string&gt; a null terminated ASCII string, name of the trace instance. Empty string ""
    is saved as name of the top instance.
    &lt;string&gt; a null terminated ASCII string, trace clock used for events timestamps in
    this trace instance.</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_header_info_section">HEADER INFO SECTION</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>Section ID: 16</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The first 12 bytes of the section, after the section header, contain the string:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>"header_page\0"</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 8 bytes are a 64-bit word containing the size of the
page header information stored next.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next set of data is of the size read from the previous 8 bytes,
and contains the data retrieved from debugfs/tracing/events/header_page.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>Note: The size of the second field \fBcommit\fR contains the target
kernel long size. For example:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>field: local_t commit;        offset:8;       \fBsize:8;\fR   signed:1;</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>shows the kernel has a 64-bit long.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 13 bytes contain the string:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>"header_event\0"</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 8 bytes are a 64-bit word containing the size of the
event header information stored next.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next set of data is of the size read from the previous 8 bytes
and contains the data retrieved from debugfs/tracing/events/header_event.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>This data allows the trace-cmd tool to know if the ring buffer format
of the kernel made any changes.</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_ftrace_event_formats_section">FTRACE EVENT FORMATS SECTION</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>Section ID: 17</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>Directly after the section header comes the information about
the Ftrace specific events. These are the events used by the Ftrace plugins
and are not enabled by the event tracing.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 4 bytes contain a 32-bit word of the number of Ftrace event
format files that are stored in the file.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>For the number of times defined by the previous 4 bytes is the
following:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>8 bytes for the size of the Ftrace event format file.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The Ftrace event format file copied from the target machine:
debugfs/tracing/events/ftrace/&lt;event&gt;/format</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_event_formats_section">EVENT FORMATS SECTION</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>Section ID: 18</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>Directly after the section header comes the information about
the event layout.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 4 bytes are a 32-bit word containing the number of
event systems that are stored in the file. These are the
directories in debugfs/tracing/events excluding the \fBftrace\fR
directory.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>For the number of times defined by the previous 4 bytes is the
following:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>A null-terminated string containing the system name.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>4 bytes containing a 32-bit word containing the number
of events within the system.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>For the number of times defined in the previous 4 bytes is the
following:</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>8 bytes for the size of the event format file.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The event format file copied from the target machine:
debugfs/tracing/events/&lt;system&gt;/&lt;event&gt;/format</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_kallsyms_section">KALLSYMS SECTION</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>Section ID: 19</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>Directly after the section header comes the information of the mapping
of function addresses to the function names.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 4 bytes are a 32-bit word containing the size of the
data holding the function mappings.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next set of data is of the size defined by the previous 4 bytes
and contains the information from the target machine's file:
/proc/kallsyms</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_trace_printk_section">TRACE_PRINTK SECTION</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>Section ID: 20</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>If a developer used trace_printk() within the kernel, it may
store the format string outside the ring buffer.
This information can be found in:
debugfs/tracing/printk_formats</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 4 bytes are a 32-bit word containing the size of the
data holding the printk formats.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next set of data is of the size defined by the previous 4 bytes
and contains the information from debugfs/tracing/printk_formats.</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_saved_command_lines_section">SAVED COMMAND LINES SECTION</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>Section ID: 21</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>Directly after the section header comes the information mapping
a PID to a process name.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next 8 bytes contain a 64-bit word that holds the size of the
data mapping the PID to a process name.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The next set of data is of the size defined by the previous 8 bytes
and contains the information from debugfs/tracing/saved_cmdlines.</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_buffer_flyrecord_section">BUFFER FLYRECORD SECTION</h2>
<div class="sectionbody">
<div class="literalblock">
<div class="content">
<pre><code>This section contains flyrecord tracing data, collected in one trace instance.
The data is saved per CPU. Each BUFFER FLYRECORD section has a corresponding BUFFER
option, containing information about saved CPU's trace data. Padding is placed between
the section header and the CPU data, placing the CPU data at a page aligned (target page)
position in the file.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>This data is copied directly from the Ftrace ring buffer and is of the
same format as the ring buffer specified by the event header files
loaded in the header format file.</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>The trace-cmd tool will try to \fBmmap(2)\fR the data page by page with the
target's page size if possible. If it fails to mmap, it will just read the
data instead.</code></pre>
</div></div>
<div class="paragraph"><p>BUFFER TEXT SECTION</p></div>
<div class="listingblock">
<div class="content">
<pre><code>  Section ID: 22

This section contains latency tracing data, ASCII text taken from the
  target's debugfs/tracing/trace file.

STRINGS SECTION</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>Section ID: 15</code></pre>
</div></div>
<div class="literalblock">
<div class="content">
<pre><code>All strings of the trace file metadata are stored in a string section within the file. The section
contains a list of nul terminated ASCII strings. An ID of the string is used in the file
meta data, which is the offset of the actual string into the string section. Strings can be stored
into multiple string sections in the file.</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_see_also">SEE ALSO</h2>
<div class="sectionbody">
<div class="paragraph"><p>trace-cmd(1), trace-cmd-record(1), trace-cmd-report(1), trace-cmd-start(1),
trace-cmd-stop(1), trace-cmd-extract(1), trace-cmd-reset(1),
trace-cmd-split(1), trace-cmd-list(1), trace-cmd-listen(1),
trace-cmd.dat(5)</p></div>
</div>
</div>
<div class="sect1">
<h2 id="_author">AUTHOR</h2>
<div class="sectionbody">
<div class="paragraph"><p>Written by Steven Rostedt, &lt;<a href="mailto:rostedt@goodmis.org">rostedt@goodmis.org</a>&gt;</p></div>
</div>
</div>
<div class="sect1">
<h2 id="_resources">RESOURCES</h2>
<div class="sectionbody">
<div class="paragraph"><p><a href="https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/">https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/</a></p></div>
</div>
</div>
<div class="sect1">
<h2 id="_copying">COPYING</h2>
<div class="sectionbody">
<div class="paragraph"><p>Copyright (C) 2010 Red Hat, Inc. Free use of this software is granted under
the terms of the GNU Public License (GPL).</p></div>
</div>
</div>
</div>
<div id="footnotes"><hr /></div>
<div id="footer">
<div id="footer-text">
Last updated
 2023-06-07 20:21:00 UTC
</div>
</div>
</body>
</html>