| Updated: April 19, 2023 |
Although the size of the buffers is fixed, the maximum number of buffers used by a system is limited only by the amount of memory.
(The tracelogger utility uses a default setting of 32 buffers, or about 500 KB of memory.)
The buffers share kernel memory with the application(s), and the kernel automatically allocates memory at the request of the data-capture utility. The kernel allocates the buffers in contiguous physical memory space. If the data-capture program requests a larger block than is available contiguously, the instrumented kernel returns an error message.
For all intents and purposes, the number of events the instrumented kernel generates is infinite. Except for severe filtering or logging for only a few seconds, the instrumented kernel will probably exhaust the ring of buffers, no matter how large it is. To allow the instrumented kernel to continue logging indefinitely, the data-capture program must continuously pipe (empty) the buffers.