Core events

Some data is collected or generated directly by the core logic in Retis and not by optional collectors. Those sections are quite generic and can't be enabled nor disabled.

Common section

{timestamp} ({smp id}) [{comm}] {pid}/{tgid}
  • timestamp can be formatted in different ways based on the configuration.

Kernel section

[{probe type}] {symbol name}
  • probe type can be "tp" (raw tracepoint), "k" (kprobe) or "kr" (kretprobe).

Userspace section

[u] {symbol name}

Tracking section

#{tracking id} (skb {skb address}) n {event index}
  • tracking id identifies a packet with a unique number across a given collection of events. It can be used to reconstruct packet flows. Note that this id can be shared between skbs, eg. for clones.
  • skb address: the address of the skb, which can be used to distinguished between skb sharing the same tracking id.
  • event index: when an event is part of a series of events (this is only available at post-processing time when using the sort sub-command), this indicates the index of the event in the series.

Startup section

Retis version {version}

Contains the version of the Retis binary that collected the event series as well as timing information for being able to display time in UTC at post-processing time. Only the version is shown in the output.

This section is emitted when a collection is started.