tracing: Add show_event_triggers to expose active event triggers

To audit active event triggers, userspace currently must traverse the
events/ directory and read each individual trigger file. This is
cumbersome for system-wide auditing or debugging.

Introduce "show_event_triggers" at the trace root directory. This file
displays all events that currently have one or more triggers applied,
alongside the trigger configuration, in a consolidated
system:event [tab] trigger format.

The implementation leverages the existing trace_event_file iterators
and uses the trigger's own print() operation to ensure output
consistency with the per-event trigger files.

Link: https://patch.msgid.link/20260105142939.2655342-3-atomlin@atomlin.com
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

authored by

Aaron Tomlin and committed by

Steven Rostedt (Google) 5 months ago 6a808388 729757b9

+72

2 changed files

expand all

Documentation

trace

ftrace.rst

kernel

trace

trace_events.c

Documentation/trace/ftrace.rst

··· 692 692 693 693 See events.rst for more information. 694 694 695 + show_event_triggers: 696 + 697 + A list of events that have triggers. This shows the 698 + system/event pair along with the trigger that is attached to 699 + the event. 700 + 701 + See events.rst for more information. 702 + 695 703 available_events: 696 704 697 705 A list of events that can be enabled in tracing.

+64

kernel/trace/trace_events.c

··· 1688 1688 return 0; 1689 1689 } 1690 1690 1691 + /** 1692 + * t_show_triggers - seq_file callback to display active event triggers 1693 + * @m: The seq_file interface for formatted output 1694 + * @v: The current trace_event_file being iterated 1695 + * 1696 + * Iterates through the trigger list of the current event file and prints 1697 + * each active trigger's configuration using its associated print 1698 + * operation. 1699 + */ 1700 + static int t_show_triggers(struct seq_file *m, void *v) 1701 + { 1702 + struct trace_event_file *file = v; 1703 + struct trace_event_call *call = file->event_call; 1704 + struct event_trigger_data *data; 1705 + 1706 + /* 1707 + * The event_mutex is held by t_start(), protecting the 1708 + * file->triggers list traversal. 1709 + */ 1710 + if (list_empty(&file->triggers)) 1711 + return 0; 1712 + 1713 + list_for_each_entry_rcu(data, &file->triggers, list) { 1714 + seq_printf(m, "%s:%s\t", call->class->system, 1715 + trace_event_name(call)); 1716 + 1717 + data->cmd_ops->print(m, data); 1718 + } 1719 + 1720 + return 0; 1721 + } 1722 + 1691 1723 #ifdef CONFIG_MODULES 1692 1724 static int s_show(struct seq_file *m, void *v) 1693 1725 { ··· 2548 2516 static int ftrace_event_avail_open(struct inode *inode, struct file *file); 2549 2517 static int ftrace_event_set_open(struct inode *inode, struct file *file); 2550 2518 static int ftrace_event_show_filters_open(struct inode *inode, struct file *file); 2519 + static int ftrace_event_show_triggers_open(struct inode *inode, struct file *file); 2551 2520 static int ftrace_event_set_pid_open(struct inode *inode, struct file *file); 2552 2521 static int ftrace_event_set_npid_open(struct inode *inode, struct file *file); 2553 2522 static int ftrace_event_release(struct inode *inode, struct file *file); ··· 2571 2538 .start = t_start, 2572 2539 .next = t_next, 2573 2540 .show = t_show_filters, 2541 + .stop = t_stop, 2542 + }; 2543 + 2544 + static const struct seq_operations show_show_event_triggers_seq_ops = { 2545 + .start = t_start, 2546 + .next = t_next, 2547 + .show = t_show_triggers, 2574 2548 .stop = t_stop, 2575 2549 }; 2576 2550 ··· 2612 2572 2613 2573 static const struct file_operations ftrace_show_event_filters_fops = { 2614 2574 .open = ftrace_event_show_filters_open, 2575 + .read = seq_read, 2576 + .llseek = seq_lseek, 2577 + .release = seq_release, 2578 + }; 2579 + 2580 + static const struct file_operations ftrace_show_event_triggers_fops = { 2581 + .open = ftrace_event_show_triggers_open, 2615 2582 .read = seq_read, 2616 2583 .llseek = seq_lseek, 2617 2584 .release = seq_release, ··· 2780 2733 ftrace_event_show_filters_open(struct inode *inode, struct file *file) 2781 2734 { 2782 2735 return ftrace_event_open(inode, file, &show_show_event_filters_seq_ops); 2736 + } 2737 + 2738 + /** 2739 + * ftrace_event_show_triggers_open - open interface for show_event_triggers 2740 + * @inode: The inode of the file 2741 + * @file: The file being opened 2742 + * 2743 + * Connects the show_event_triggers file to the sequence operations 2744 + * required to iterate over and display active event triggers. 2745 + */ 2746 + static int 2747 + ftrace_event_show_triggers_open(struct inode *inode, struct file *file) 2748 + { 2749 + return ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops); 2783 2750 } 2784 2751 2785 2752 static int ··· 4518 4457 4519 4458 trace_create_file("show_event_filters", TRACE_MODE_READ, parent, tr, 4520 4459 &ftrace_show_event_filters_fops); 4460 + 4461 + trace_create_file("show_event_triggers", TRACE_MODE_READ, parent, tr, 4462 + &ftrace_show_event_triggers_fops); 4521 4463 4522 4464 nr_entries = ARRAY_SIZE(events_entries); 4523 4465

Configure Feed

Configure Feed