Event interlacing
Although events are timestamped immediately, they may not be written to the buffer in a single operation (atomically).
When multiple buffer slot events (combine events
) are being written to the buffer, the process is frequently interrupted
to allow other threads and processes to run. Events triggered by higher-priority threads are often written to the buffer first.
Thus, events may be interlaced.
Although events may not be contiguous, they are not scrambled (unless there's a buffer overrun). The sequential order of the combine event is always correct, even if it's interrupted with a different event.
To maintain speed during runtime, the instrumented kernel writes events unsorted as quickly as possible; reassembling the combine events must be done in post-processing. The libtraceparser API transparently reassembles the events.