The program that captures data is the messenger between the instrumented kernel and the filesystem.
The main function of the data-capture program is to send the buffers given to it by the instrumented kernel to an output device (which may be a file or something else). In order to accomplish this function, the program must also:
You must configure the instrumented kernel before logging. The instrumented kernel configuration settings include:
We've provided tracelogger as the default data-capture utility. Although you can write your own utility, there's little need to.
You can control the capture of data via qconn (under the control of the IDE), tracelogger (from the command line), or directly from your application. All three approaches use the TraceEvent() function to control the instrumented kernel:
For information about controlling the trace from the IDE, see the Analyzing System Behavior chapter of the IDE User's Guide.
Let's look first at using tracelogger, and then we'll describe how you can use TraceEvent() to control tracing from your application.
The traceprinter utility doesn't have any issues with such traces because it doesn't attempt to reorder the data and interpret it; it simply dumps the contents of each event.