Kernel Buffer Management
As the instrumented kernel intercepts events, it stores them in a space consisting of several rings of buffers, with one ring per CPU.
This arrangement of buffer space means events are captured independently on each CPU. To capture all events, the data-capture process must bind a thread to each CPU and then issue the _NTO_TRACE_WAITBUFFER command. When a given buffer fills, the _NTO_TRACE_WAITBUFFER command returns and the thread that's bound to that CPU can then read the buffer contents. The kernel then starts writing events to the next buffer in that ring.
Ring buffer size. But each buffer is of a fixed size and is divided into a fixed number of slots:
- Event buffer slots per buffer: 1011
- Event buffer slot size: 16 bytes
- Buffer size: 16 KB, including overhead of buffer header
Some events are single buffer slot events (simple events
) while others are multiple buffer slot events
(combine events
). In either case there is only one event, but the number of event buffer slots required to
describe it may vary.
For more details, see the
Interpreting Trace Data
chapter.