tracelogger's modes of operation

You can run tracelogger in several modes—depending on how and what you want to trace—by specifying the following command-line options:

-n iterations
In this mode, the kernel logs events, and tracelogger captures iterations buffers worth of data, and then terminates. This is the default mode, and default number of iterations is 32.
-r
Ring mode: the kernel stores all events in its circularly linked list of buffers without flushing them. The maximum time for which you can capture events (without overwriting earlier ones) is determined by the number of allocated buffers, as well as by the number of generated trace events.

In ring mode, tracelogger doesn't capture the events until it gets a SIGINT signal (e.g., you press CtrlC), or an application calls TraceEvent() with a command of _NTO_TRACE_STOP.

If you don't specify the -r option, tracelogger runs in linear mode; every filled-up buffer is captured and flushed immediately.

-d1
Daemon mode: the kernel doesn't log events, and tracelogger doesn't capture them until an application calls TraceEvent() with a command of _NTO_TRACE_START. Logging continues until an application calls TraceEvent() with a command of _NTO_TRACE_STOP, or you terminate tracelogger.
Note: In daemon mode, tracelogger ignores any other options, unless you also specify the -E option to use extended daemon mode.
-s seconds
The kernel logs events; tracelogger captures them over the specified time.
-c
The kernel logs events; tracelogger captures then, and continues to do so until you terminate it.

All of the above, except for daemon mode, constitute normal mode. In normal mode, you configure, start, and stop the tracing from the command line; in daemon (-d1) mode, your application must do everything from code. However, if you also use the -E option, you get the best of both modes: the command-line configuration of normal mode, and the full control of daemon mode.

Here's an outline of the strengths, weaknesses, and features of these modes:

Feature Normal mode Daemon mode Extended daemon mode
tracelogger support Full Limited Full
Controllability Limited Full Full
Events recorded by default All None All
Configuration difficulty Easy Harder Easy
Configuration method Command line only User program, using calls to TraceEvent() Command line and user program
Logging starts Instantaneously Through a user program; also calls to TraceEvent() Through a user program; also calls to TraceEvent()

For a full description of the tracelogger utility and its options, see its entry in the Utilities Reference.