The LTTng kernel and user-space tracer can help solve a wide variety of
problems (especially those hard to reproduce ones). There are four main ways of
extracting and processing an LTTng trace, and each of them addresses a
different use-case. In this presentation we will demonstrate these modes and
present real-world situations where they can be used. If you already know how
to use LTTng you will learn new ways this tool can help you, and if you don't,
you will probably discover a new way to address these complex problems.
The modes we will demonstrate are: post-processing mode (default), snapshot
mode, live mode and the new rotation mode.
All of these modes have their pros and cons in a context of monitoring and
cloud and we will be happy to discuss with the crowd to see how to address
their particular use-cases and help them gain a full-system insight.
The intended audience is devops engineers having to deal with complex
problems and look for a way to scale their monitoring and debugging method
on a small or large fleet of servers.
Here is a summary of the modes we will demonstrate and their main use-cases:
- post-processing mode (default): gather as much data as possible and take
the time to investigate (debugging, logging);
- snapshot mode: when an error is detected, extract the last trace buffer
from memory (fault investigation, sampling, low impact monitoring);
- live mode: continuously monitor a stream of events (logging, monitoring);
- rotation mode: periodically, or on a specific trigger, process a chunk of
trace without stopping the tracing (monitoring, logging, archiving
sampling).