How to filter EventSource events with lttng

Question

USING: .NET Core 2.2 on linux UST tracing / lttng.

I am trying to only listen for Custom EventSource events (and some other events I am specifically interested in but they do not factor into this discussion) I have generated in my application. I am sending these messages off box to an lttng-relayd daemon and I am looking to keep the amount of event data somewhat in my control. Turning on the EventSource provider generates a great deal of information I don't want or need and it is flooding my channel on occasion.

lttng enable-event --userspace --tracepoint DotNETRuntime:EventSource

When I look at the data this is pushing to relayd I am seeing all sorts of built in events I would like to simply avoid sampling at all:

=== DotNETRuntime:EventSource__System.Diagnostics.Eventing.FrameworkEventSource - ThreadTransferSend:11542 - ThreadTransferReceive:6480 - ThreadPoolEnqueueWork:21437 - ThreadPoolDequeueWork:21437 === DotNETRuntime:EventSource__Microsoft-System-Net-Sockets - Enter:22771 - Info:27463 - Exit:20145 - Connected:1 - Accepted:1 === DotNETRuntime:EventSource__Microsoft-System-Net-NameResolution - Enter:41924 - Info:41922 - Exit:27950

These are all produced by .NET and I really have little interest in capturing these events, only my application specific set of events.

I am trying to figure out the --filter syntax I might use to filter for just my set of custom events:

--filter='$app.EventSourceName==MyEventSourceName'

The examples I can find online references either static events:

$ctx.procname=='dotnet'

Which is not that useful.

Or dynamic events using $app, but the syntax I need to use to filter by EventSourceName is not very clear.

Is there anyone who has experience with this aspect of lttng who might

JPBlanc · Answer 1 · 2020-02-22T17:39:36.897

First allow tracing :

export COMPlus_PerfMapEnabled=1
export COMPlus_EnableEventLog=1

or using PowerShell

$env:COMPlus_PerfMapEnabled=1
$env:COMPlus_EnableEventLog=1

According to the following code :

using System.Diagnostics.Tracing;
using System.Collections.Generic;
using System;

namespace Demo1
{
    [EventSource(Name = "JPBLog")]
    class MyCompanyEventSource : EventSource
    {
        public static MyCompanyEventSource Log = new MyCompanyEventSource();

        [Event(1, Message="{0} -> {1}", Channel = EventChannel.Admin)]
        public void Startup() { WriteEvent(1); }

        [Event(2, Message="{0}", Channel = EventChannel.Admin)]
        public void OpenFileStart(string fileName) { WriteEvent(2, fileName); }

        [Event(3, Message="OpenFileStop", Channel = EventChannel.Admin)]
        public void OpenFileStop() { WriteEvent(3); }
    }

    class Program
    {
        static void Main(string[] args)
        {
            string name = MyCompanyEventSource.GetName(typeof(MyCompanyEventSource));
            Console.WriteLine(name);
            IEnumerable<EventSource> eventSources = MyCompanyEventSource.GetSources();
            foreach(EventSource iS in eventSources){
              Console.WriteLine(iS);
            }
            MyCompanyEventSource.Log.Startup();
            // ...
            MyCompanyEventSource.Log.OpenFileStart("SomeFile");
            // ...
            MyCompanyEventSource.Log.OpenFileStop();
        }
    }
}

Here is how I filter only my events :

lttng create my-trace -o ./my-trace
lttng enable-channel --userspace DotNetCoreChannel
lttng enable-event --userspace --tracepoint DotNETRuntime:EventSource --channel=DotNetCoreChannel --filter "EventSourceName=='JPBLog'"
lttng start
dotnet run # here I run the code
lttng stop
lttng view

You will receive :

[17:24:45.219954500] (+?.?????????) cd9a097f0904 DotNETRuntime:EventSource: { cpu_id = 0 }, { EventID = 1, EventName = "Startup", EventSourceName = "JPBLog", Payload = "" }
[17:24:45.223259100] (+0.003304600) cd9a097f0904 DotNETRuntime:EventSource: { cpu_id = 0 }, { EventID = 2, EventName = "OpenFileStart", EventSourceName = "JPBLog", Payload = "{\"EventSource_Message\":\"{0}\", \"fileName\":\"SomeFile\"}" }
[17:24:45.223417300] (+0.000158200) cd9a097f0904 DotNETRuntime:EventSource: { cpu_id = 0 }, { EventID = 3, EventName = "OpenFileStop", EventSourceName = "JPBLog", Payload = "" }

How to filter EventSource events with lttng

1 Answers1