lttng-untrack - Disallow specific processes to record LTTng events

Copyright

       This program is part of the LTTng-tools project.

       LTTng-tools is distributed under the GNU General Public License version 2
       <http://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html>. See the LICENSE
       <https://github.com/lttng/lttng-tools/blob/master/LICENSE> file for details.

Description

       The lttnguntrack command disallows one or more processes to record LTTng events based on their
       attributes within:

       With the --session=SESSION option
           The recording session named SESSION.

       Without the --session option
           The current recording session (see lttng-concepts(7) to learn more about the current recording
           session).

       See lttng-concepts(7) to learn more about recording sessions and recording event rules.

       The untrack command removes values from inclusionsets of process attributes. See lttng-track(1) to learn
       more about inclusion sets.

       See the “EXAMPLES” section below for usage examples.

   Inclusionsetexample
       A common operation is to create a recording session (see lttng-create(1)), remove all the entries from
       the Linux kernel process ID inclusion set, start recording, and then manually add PIDs while the
       recording session is active.

       Assume the maximum system PID is 7 for this example.

        1. Command:

               $ lttng create

           Initial inclusion set:

               [0] [1] [2] [3] [4] [5] [6] [7]

        2. Command:

               $ lttng untrack --kernel --all --pid

           Inclusion set:

               [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ]

        3. Commands:

               $ lttng enable-event --kernel ...
               $ lttng start
               $ # ...
               $ lttng track --kernel --pid=3,5

           Inclusion set:

               [ ] [ ] [ ] [3] [ ] [5] [ ] [ ]

        4. Command:

               $ lttng track --kernel --pid=2

           Inclusion set:

               [ ] [ ] [2] [3] [ ] [5] [ ] [ ]

Environment

LTTNG_ABORT_ON_ERROR
           Set to 1 to abort the process after the first error is encountered.

       LTTNG_HOME
           Path to the LTTng home directory.

           Defaults to $HOME.

           Useful when the Unix user running the commands has a non-writable home directory.

       LTTNG_MAN_BIN_PATH
           Absolute path to the manual pager to use to read the LTTng command-line help (with lttng-help(1) or
           with the --help option) instead of /usr/bin/man.

       LTTNG_SESSION_CONFIG_XSD_PATH
           Path to the directory containing the session.xsd recording session configuration XML schema.

       LTTNG_SESSIOND_PATH
           Absolute path to the LTTng session daemon binary (see lttng-sessiond(8)) to spawn from the lttng-create(1) command.

           The --sessiond-path general option overrides this environment variable.

Examples

Example1.RemovethePIDs1728and3775fromtheLinuxkernelprocessIDinclusionsetofthecurrentrecordingsession.

           See the --pid option.

               $ lttng untrack --kernel --pid=1728,3775

       Example2.RemovetheIDsofaspecificgroupsfromtheuserspacevirtualgroupIDinclusionsetofaspecificrecordingsession.

           See the --vgid and --session options.

               $ lttng untrack --userspace --session=my-session \
                               --vgid=docker,mysql

       Example3.RemovealltheuserIDsfromtheLinuxkerneluserIDinclusionsetofthecurrentrecordingsession.

           See the --all and --uid options.

               $ lttng untrack --kernel --all --uid

Exit Status

0
           Success

       1
           Command error

       2
           Undefined command

       3
           Fatal error

       4
           Command warning (something went wrong during the command)

Files

$LTTNG_HOME/.lttngrc
           Unix user’s LTTng runtime configuration.

           This is where LTTng stores the name of the Unix user’s current recording session between executions
           of lttng(1).  lttng-create(1) and lttng-set-session(1) set the current recording session.

       $LTTNG_HOME/lttng-traces
           Default output directory of LTTng traces in local and snapshot modes.

           Override this path with the --output option of the lttng-create(1) command.

       $LTTNG_HOME/.lttng
           Unix user’s LTTng runtime and configuration directory.

       $LTTNG_HOME/.lttng/sessions
           Default directory containing the Unix user’s saved recording session configurations (see lttng-save(1) and lttng-load(1)).

       /etc/lttng/sessions
           Directory containing the system-wide saved recording session configurations (see lttng-save(1) and
           lttng-load(1)).

       Note$LTTNG_HOME defaults to the value of the HOME environment variable.

Name

       lttng-untrack - Disallow specific processes to record LTTng events

Options

       See lttng(1) for GENERALOPTIONS.

   Tracingdomain
       One of:

       -k, --kernel
           Remove values from one or more Linux kernel inclusion sets.

       -u, --userspace
           Remove values from one or more user space inclusion sets.

   Recordingtarget-sSESSION, --session=SESSION
           Remove values from one or more inclusion sets of the recording session named SESSION instead of the
           current recording session.

   Inclusionsetselection-p [PID[,PID]...], --pid[=PID[,PID]...]
           For each PID argument, remove PID from the process ID inclusion set of the selected recording session
           and domain.

           PID is the process ID attribute of a process as seen from the root PID namespace (see
           pid_namespaces(7)).

           Only available with --kernel option.

       --vpid[=VPID[,VPID]...]
           For each VPID argument, remove VPID from the virtual process ID inclusion set of the selected
           recording session and domain.

           VPID is the virtual process ID attribute of a process as seen from the PID namespace of the process
           (see pid_namespaces(7)).

       --uid[=USER[,USER]...]
           For each USER argument, remove USER from the user ID inclusion set of the selected recording session
           and domain.

           USER is either:

           •   The real user ID (see getuid(3)) of a process as seen from the root user namespace (see
               user_namespaces(7)).

           •   A user name.

               The connected LTTng session daemon (see lttng-sessiond(8)) performs the user name resolution on
               removal from the user ID inclusion set.

           Only available with --kernel option.

       --vuid[=VUSER[,VUSER]...]
           For each VUSER argument, remove VUSER from the virtual user ID inclusion set of the selected
           recording session and domain.

           VUSER is either:

           •   The real user ID (see getuid(3)) of a process as seen from the user namespace (see
               user_namespaces(7)).

           •   A user name.

               The connected LTTng session daemon (see lttng-sessiond(8)) performs the user name resolution on
               removal from the virtual user ID inclusion set.

       --gid[=GROUP[,GROUP]...]
           For each GROUP argument, remove GROUP from the group ID inclusion set of the selected recording
           session and domain.

           GROUP is either:

           •   The real group ID (see getgid(3)) of a process as seen from the root user namespace (see
               user_namespaces(7)).

           •   A group name.

               The connected LTTng session daemon (see lttng-sessiond(8)) performs the group name resolution on
               removal from the group ID inclusion set.

           Only available with --kernel option.

       --vgid[=VGROUP[,VGROUP]...]
           For each VGROUP argument, remove VGROUP from the virtual group ID inclusion set of the selected
           recording session and domain.

           VGROUP is either:

           •   The real group ID (see getgid(3)) of a process as seen from the user namespace (see
               user_namespaces(7)).

           •   A group name.

               The connected LTTng session daemon (see lttng-sessiond(8)) performs the group name resolution on
               removal from the virtual group ID inclusion set.

   Inclusionsetoperation-a, --all
           With one or more empty --pid, --vpid, --uid, --vuid, --gid, and --vgid options: clear the selected
           inclusion sets.

   Programinformation-h, --help
           Show help.

           This option attempts to launch /usr/bin/man to view this manual page. Override the manual pager path
           with the LTTNG_MAN_BIN_PATH environment variable.

       --list-options
           List available command options and quit.

Resources

       •   LTTng project website <https://lttng.org>

       •   LTTng documentation <https://lttng.org/docs>

       •   LTTng bug tracker <https://bugs.lttng.org>

       •   Git repositories <https://git.lttng.org>

       •   GitHub organization <https://github.com/lttng>

       •   Continuous integration <https://ci.lttng.org/>

       •   Mailing list <https://lists.lttng.org/> for support and development: lttng-dev@lists.lttng.org

       •   IRC channel <irc://irc.oftc.net/lttng>: #lttng on irc.oftc.net

Synopsis

       Disallow specific processes to record Linux kernel events:

       lttng [GENERALOPTIONS] untrack--kernel [--session=SESSION]
             (--pid=PID[,PID]... | --vpid=VPID[,VPID]... |
              --uid=UID[,UID]... | --vuid=VUSER[,VUSER]... |
              --gid=GID[,GID]... | --vgid=VGROUP[,VGROUP]...)...

       lttng [GENERALOPTIONS] untrack--kernel [--session=SESSION]
             --all (--pid | --vpid | --uid | --vuid | --gid | --vgid)...

       Disallow specific processes to record user space events:

       lttng [GENERALOPTIONS] untrack--userspace [--session=SESSION]
             (--vpid=VPID[,VPID]... | --vuid=VUSER[,VUSER]... |
              --vgid=VGROUP[,VGROUP]...)...

       lttng [GENERALOPTIONS] untrack--userspace [--session=SESSION]
             --all (--vpid | --vgid | --vuid)...

Thanks

       Special thanks to Michel Dagenais and the DORSAL laboratory <http://www.dorsal.polymtl.ca/> at École
       Polytechnique de Montréal for the LTTng journey.

       Also thanks to the Ericsson teams working on tracing which helped us greatly with detailed bug reports
       and unusual test cases.