Understanding Software Dynamics

Chapter 14

KUtrace: Goals, Design, Implementation

KUtrace is a Linux-based software facility that captures and timestamps every transition between user-mode and kernel-mode execution—every system call and return, interrupt and return, trap and return, and context switch. The CPU overhead is under 0.5% when doing 200,000 events per second per CPU core, so it is about 10x faster than a tool such as ftrace. Recording is into a pre-reserved kernel trace buffer of several megabytes.

14.1 Overview

To achieve its speed, KUtrace records only 4 bytes per event—20 bits of timestamp and 12 bits of event number. In reality, pairs of events are recorded in 8-byte entries. Everything else to turn traces into meaningful insight is done via postprocessing, ...