# Introduction

LTTng (Linux Trace Toolkit, next generation) is a highly efficient tracing tool for Linux that can be used to track down kernel and application performance issues as well as debug problems involving multiple concurrent processes and threads. It consists of a set of kernel patches, a daemon - to collect the raw tracing data - and a set of tools to control, visualize and analyze the generated data.

The LTTng plug-in for Eclipse provides an Eclipse integration for the control, fetching and visualization of LTTng traces. It also provides the foundation for user-defined analysis tools.

At present, the LTTng Eclipse plug-in for Eclipse supports the following kernel-oriented analyses:

- Control Flow - to visualize processes state transition
- Resources - to visualize system resources state transitions
- Statistics - to provide simple statistics on event occurences

For more information about LTTng, refer to the project site

## About Tracing

Tracing is a troubleshooting technique used to understand the behavior of an instrumented application by collecting information on its execution path. A tracer is the software used for tracing. Tracing can be used to debug a wide range of bugs that are otherwise extremely challenging. These include, for example, performance problems in complex parallel systems or real-time systems.

Tracing is similar to logging: it consists in recording events that happen in a system at selected execution locations. However, compared to logging, it is generally aimed at developers and it usually records low-level events at a high rate. Tracers can typically generate thousands of events per second. The generated traces can easily contain millions of events and have sizes from many megabytes to tens of gigabytes. Tracers must therefore be optimized to handle a lot of data while having a small impact on the system.

Traces may include events from the operating system kernel (IRQ handler entry/exit, system call entry/exit, scheduling activity, network activity, etc). They can also consists of application events (a.k.a UST - User Space Tracing) or a mix of the two.

For the maximum level of detail, tracing events may be viewed like a log file. However, trace analyzers and viewers are available to produce useful information from the raw data. These programs must be specially designed to handle quickly the enormous amount of data a trace may contain.

In the case of LTTng, low tracing overhead is achieved by instrumenting the Linux kernel with a set of custom patches. The same set of patches can be used for tracing both the Linux kernel and user applications (UST).

## Traces and Experiments

In the scope of the LTTng plug-in for Eclipse, a trace is essentially a set of time-ordered LTTng events. The LTTng application can read these traces and provide a number of standard views to analyze their contents.

An experiment consists in an arbitrary number of aggregated LTTng traces for purpose of correlation. In the degenerate case, an experiment can consist of a single trace.

The experiment provides a unified, time-ordered stream of the individual LTTng trace events.