Home > Veritas Storage Foundation™ Cluster File System Manual Pages
Table of contents
ktrace - dump kernel trace buffer
ktrace
[-vtFd]
[-sscale]
[-e[mask]]
[-bnum_ent]
ktrace
[-vt]
[-sscale]
[namelist [corefile]]
Certain kernel modules may employ the
KOFF
(Kernel Obscure Feature Finder)
trace functions, which log trace records into a circular
buffer in kernel memory.
The
ktrace
programme will locate these trace records, format them, and print
them on the standard output.
The first synopsis is for a running system, while the second is for a
crash dump. Arguments which modify the tracing state (-F, -d, -e, -b)
can only be applied to a running system.
-
namelist
-
The name of a file containing the symbolic names of the kernel symbols.
For kernel crash dumps, this is typically
vmunix.
N
where N is some integer.
If a running system is being examined, no namelist file need be provided.
-
corefile
-
The name of a file containing the memory image of the kernel.
For kernel crash dumps, this is typically
vmcore.
N
where N is the same integer as above.
-
-v
-
Increase the level of verbosity of the programme output.
-
-F
-
Flush the trace buffer.
For the
ODM
version,
this is accomplished by writing to
/dev/odm/ktrace.
-
-s scale
-
Timestamps are recorded with nanosecond resolution, but they are
reported restricted to a range of 16 bits, and are thus scaled,
by default, to milliseconds, using a scale factor of 1,000,000.
By supplying a different scaling factor, increased resolution of the
timestamps is displayed, although the delta is still limited to
a 16 bit value.
-
-e [mask]
-
Enable tracing and set the trace event mask. If no mask
is specified, restore the last mask used.
-
-d
-
Disable tracing.
-
-b num_ent
-
Size the kernel trace buffer to accommodate
num_ent
entries. The buffer
will not actually be allocated until
tracing is enabled with '-e'. If a buffer has
already been allocated, it can not be freed or
resized, and this option will report an error.
The default buffer size is 32768 entries.
KOFF
trace records are fixed format entries made to a circular buffer.
The data recorded are as follows.
-
tid
-
The thread identifier of the currently executing thread.
This can assist in correlating entries made simultaneously
by several different threads.
-
ticks
-
A nanosecond resolution time stamp.
The current time to the nanosecond is recorded in the trace entry at
the time it is made.
The system timer might lack actual nanosecond granularity, so some
low order bits might always be zero.
-
id
-
A trace record correlator ID.
Certain traces might share a common data structure, and this will be
typically supplied as the trace ID to correlate the entries.
-
fmt
-
A
printf(3)
- style format string.
The format of this format string is restricted.
There can be no more than 5 formatting arguments, and the
total bytes represented by these formatting arguments cannot
exceed 5 times the native size of a pointer.
The format string is typically formed as follows.
A
tag
prefix, containing no formatting selection characters
(%)
followed by a
colon
(:).
The
ktrace
output is formatted so as to line up all the
\':\' characters, truncating and right aligning the tag as necessary.
Following the tag is usually a single blank, but
certain trace entries can place characters there as attention
grabbers.
Typically \'*\' and \'!' are used, for errors and
alerts respectively.
It is the discretion of the programmer who constructed the trace
string which conventions are used.
The remainder of the format string contains text and formatting
characters, to display the optional arguments.
-
args
-
Five argument values are recorded in each trace entry.
The format string might refer to none or all of these, causing the
values to be displayed.
The output format has two record types.
The first is the time stamp, which represents the
time of day in
ctime(3)
format, which represents all the whole seconds, preceded by a
4 digit hexadecimal value representing the scaled nanosecond value.
Consider the following example.
0304+Wed May 16 12:19:16 2001
This indicates a time stamp of 772 milliseconds (304 base 16)
past 16 seconds past 19 minutes past noon on May 16, 2001.
As the range of the 4 hexadecimal digits is from zero
to 65535, no information is lost, but if the scale factor is set lower,
it is possible for this offset to be meaningless.
The second record format is the trace record, which is comprised
of the following fields.
-
tid
-
The thread ID field is 8 hexadecimal digits
representing the lower 32 bits of the thread identifier.
This field is followed by a \':\'.
-
delta
-
The delta is four hexadecimal digits of offset from the last
time stamp record.
This field is followed by a \':\'.
-
correl
-
The correlator field is 8 hexadecimal digits representing the
lower 32 bits of the correlator value.
This field is followed by a \' \'.\"boldly spacing
-
tag
-
The tag field is 10 characters of right adjusted tag information
from the format string.
-
rest
-
The rest of the line is comprised of the formatted trace entry.
The following output illustrates some aspects.
0304+Wed May 16 12:19:16 2001
001bdd20:0000:00000000 _init:
00fe5d20:0c76:00000000 io_reaper: sleep
05c6d780:0ca8:00000000 odmmount: vfsp 3f7738 mvp 43fab8
001bdd20:c42c:00000000 _fini:
034a+Wed May 16 12:20:24 2001
05325440:0000:7836c820 odmgetattr: flags 10
05325440:0000:7836c820 odmgetattr: flags 10
The first field of each non-timestamp trace entry is the thread ID.
The first four trace entries have a zero valued correlator.
The first one has a delta of zero, because the time stamp on the
previous line establishes the base for the deltas, and it's timestamp
is of the record in question.
The second trace entry has a delta of
0c76
or 3,190 milliseconds past the time stamp.
New timestamp lines are emitted whenever the delta would
overflow 16 bits, and at least every 100 output lines.
The fifth trace entry happened about 64 seconds after the
time the timestamp output line reports, which would cause the
delta to overflow.
Accordingly, a new timestamp output line has been emitted, reestablishing
the base for the deltas.
The fifth and sixth trace entries have the same correlator.
The source code of the programme in question must be consulted to
make sense of the trace entries, and their correlators.
Undoubtedly.
Last updated: April 1, 2001
Copyright ©2009 Symantec Corporation
All rights reserved.