Buffer overruns

The instrumented kernel is both the very core of the system and the controller of the event buffers.

When the kernel is busy, it logs more events. The buffers fill more quickly, and the kernel requests that the buffers be flushed more often. The data-capture program handles each flush request; the instrumented kernel switches to the next buffer and continues logging events. In an extremely busy system, the data-capture program may not be able to flush the buffers as quickly as the kernel fills them.

In a three-buffer scenario, the kernel fills buffer 1 and raises an _NTO_HOOK_TRACE synthetic interrupt to notify the data-capture program that the buffer is full. The data-capture program takes ownership of buffer 1 and the kernel marks the buffer as busy/in use. If, say, the file is being saved to a hard drive that happens to be busy, then the kernel may fill buffer 2 and buffer 3 before the data-capture program can release buffer 1. In this case, the kernel skips buffer 1 and writes to buffer 2. The previous contents of buffer 2 are overwritten and the timestamps on the event buffer slots will show a discontinuity.

For more on buffer overruns, see the Tutorials chapter.