ftrace
/ EFF-trayss /
Suppose you want to watch the kernel from the inside — to see which kernel functions get called when your program does something, and in what order. ftrace is the tracer built directly into the Linux kernel itself for exactly this. You do not install anything; the capability is already compiled in, and you drive it by reading and writing special files. Its standout feature is the function tracer: it can record entry into kernel functions as they happen.
Here is how it actually works. ftrace is controlled through a virtual filesystem, traditionally mounted at /sys/kernel/tracing (this is tracefs). You configure and run a trace by writing plain text into its control files and reading results back out — for example writing 'function' into the file 'current_tracer' turns on the function tracer, and reading the file 'trace' gives you the captured output. The plain function tracer logs each kernel function as it is entered, which is a firehose. The more readable function-graph tracer instead shows calls as a nested, indented call tree with the duration of each call printed next to it, so you can SEE the shape of execution and where the time went inside the kernel — much like a flame graph in text form. You can filter to specific functions so you are not drowned, and you can trace a single process. Under the hood the function tracer relies on compiler-inserted hooks (the kernel is built with mcount/fentry stubs) that ftrace patches in and out at run time.
It matters because it is the always-available, dependency-free way to trace the kernel — on essentially any modern Linux box you can start tracing in a few echo commands with no extra software, which is invaluable in a locked-down production environment. The honest caveats: full-function tracing is high overhead and produces enormous output, so you almost always filter; it traces the kernel, not your user-space application logic; and although the raw file interface works everywhere, it is fiddly, which is why higher-level front-ends (trace-cmd, and perf's ftrace mode) exist to drive it more comfortably.
$ cd /sys/kernel/tracing $ echo function_graph > current_tracer $ echo 1 > tracing_on ; sleep 1 ; echo 0 > tracing_on $ cat trace # 2.114 us | vfs_read() { # 1.882 us | ext4_file_read_iter(); # | }
The function-graph tracer, driven entirely through tracefs files, shows a nested call tree with per-call durations inside the kernel.
ftrace is not one tool but a framework: kprobes, uprobes, and tracepoints are all surfaced through the same tracefs interface, so 'ftrace' often refers to the whole kernel tracing machinery, of which the function tracer is just the best-known part.