On Wed, 6 Aug 2025 11:50:06 +0100 Douglas Raillard <[email protected]> wrote:
> On 05-08-2025 20:26, Steven Rostedt wrote: > > From: Steven Rostedt <[email protected]> > > > > When a system call that reads user space addresses copy it to the ring > > buffer, it can copy up to 511 bytes of data. This can waste precious ring > > buffer space if the user isn't interested in the output. Add a new file > > "syscall_user_buf_size" that gets initialized to a new config > > CONFIG_SYSCALL_BUF_SIZE_DEFAULT that defaults to 128. > > Have you considered dynamically removing some event fields ? We routinely hit > the same problem with some of our events that have rarely-used large fields. We do that already with eprobes. Note, syscall events are pseudo events hooked on the raw_syscall events. Thus modifying what is displayed is trivial as it's done manually anyway. For normal events, it's all in the TRACE_EVENT() macro which defines the fields at boot. Trying to modify it later is very difficult. > > If we could have a "fields" file in /sys/kernel/tracing/events/*/*/fields > that allowed selecting what field is needed that would be amazing. I had plans > to build something like that in our kernel module based on the synthetic > events API, > but did not proceed as that API is not exported in a useful way. Take a look at eprobes. You can make a new event based from an existing event (including other dynamic events and syscalls). I finally got around to adding documentation about it: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/trace/eprobetrace.rst -- Steve
