Debugging Linux Kernel using ftrace Part6 - trace vs trace_pipe

ftrace internally uses a ring buffer of fixed size. The size can be find out by reading "buffer_size_kb" file. If the buffer becomes full, it will overwrite the starting tracing entries.

$ cat buffer_size_kb
1410

To read this ring buffer, we can cat either of the two files present in /sys/kernel/tracing folder:

• trace
• trace_pipe

What is difference between trace and trace_pipe?

Difference between the two files is that "trace" file is static. Each time you read the contents of "trace" file it will print the same tracing entries, whereas with trace_pipe, each time you read the file the data is consumed, and in the next read data will be different also if there is no data trace_pipe will block.

Let's try to understand by running the commands.

You can see, I did the following steps:

• Enabled the "function_graph" tracer
• Then I read both the "trace" and "trace_pipe" files, it displayed the same content
• Then disabled tracing by running "echo '0' > tracing_on"
• Then I read trace, it printed the contents of ftrace ring buffer
• I then redirected the output of trace_pipe to /dev/null, which consumed the ftrace ring buffer
• Now when I do "cat trace", there is no output as all the data was consumed when reading trace_pipe

You can think of  trace_pipe as live stream of ftrace ring buffer.

If you do 'cat trace' while tracing is going on, it will stop trace and print the contents and then starts recording traces. So, reading the trace file can affect your recording of the trace, whereas reading 'trace_pipe' doesn't.