Search code examples
perf

What do the different fields in PERF_RECORD_SAMPLE mean?

I'm trying to understand how the event samples are collected by perf on an ARM-based IoT device that runs Debian Wheezy. For now, I am looking at the page-faults events, and record the data for each sample.

I am collecting the perf samples using -c 1. A typical PERF_RECORD_SAMPLE data looks like this.

2138094219370 0x15a8 [0x48]: PERF_RECORD_SAMPLE(IP, 2): 2408/2408: 0xb6f93820 period: 1 addr: 0xb6f93820

I have found documentation and sources that explain what most of the fields mean, but I am unable to find out what the first two fields mean. I am essentially looking for anything that gives more information about the state of the application when this sample was collected, e.g. how much time (or clock cycles) have passed when a sample was collected, and I was wondering if those fields give any information on that.

Any help regarding this is appreciated.

Solution

  • The first field is the timestamp of the event, which represents the system running time in nanoseconds. You can subtract the timestamps of two consecutive samples to know how much time has passed between them. For the sample you have shown, the timestamp is 2138094219370.

    The second field is the offset of the sample record within the file in which the sample is stored.

    For completeness, here is the meaning of the rest of the fields:

    • 0x48 is the size of the sample record in bytes.
    • PERF_RECORD_SAMPLE is the type of the sample.
    • IP indicates that the sample includes the instruction pointer at the time the sample is taken.
    • 2 indicates that the sample was taken in user mode.
    • 2408/2408 are the process and thread IDs, respectively.
    • 0xb6f93820 is the IP.
    • "period: 1" is the sampling period. I'm not sure what the unit of the period is.
    • "addr: 0xb6f93820" is the same as IP for this particular sample (because it only includes IP as mentioned above). addr could contain other information depending on the sample. I think this also depends on what tool you used to print the sample.

    I've figured all of that out by looking at the code:

    • The timestamp is printed here.
    • The next few fields are printed here.
    • The rest of the fields are printed here.

    After that, other information could be printed in the dump_sample function, depending what else is there in the sample.