The post-processing facility

The post-processing facility is different from the other filters in that it reacts to the events without permanently discarding them (or having to choose not to). Because the processing is done on the captured data, often saved as a file, you could make multiple passes on the same data without changing it—one pass could count the number of thread state changes, and another pass could display all the kernel events.

This facility is a collection of callback functions that decide what to do for each event. One example of post-processing is the traceprinter utility. It prints all the events instead of filtering them, but the principles are the same.

We'll look at traceprinter in more detail in the Interpreting Trace Data chapter.