[v2 PATCH 0/2] tracing: Expose global views of active filters and triggers

[v2 PATCH 0/2] tracing: Expose global views of active filters and triggers

[Aaron Tomlin]

Hi Steve,

Currently, auditing active Ftrace event filters or triggers requires userspace
to recursively traverse the "events/" directory and read the "filter" or
"trigger" file for every individual event. For monitoring tools, security
auditors, or developers debugging complex tracing setups, this O(n) traversal
is inefficient and cumbersome.

This series introduces two new files at the trace root directory to provide
a consolidated, system-wide view of active event configurations:

    1. show_event_filters: Displays all events with an active filter
    2. show_event_triggers: Displays all events with active triggers

Both files utilise the system:event [tab] config format, allowing for easy
parsing by standard tools (e.g., awk) or custom monitoring agents.

The patches leverage the existing trace_event_file iterators to ensure atomic
and efficient traversal of the event list. Scope-based RCU protection
(guard(rcu)) is used for filter string access, whilst the existing event_mutex
protection within the iterator ensures safe traversal of the event trigger
lists. For triggers, we utilise the internal cmd_ops->print() callbacks to 
guarantee that the consolidated output remains consistent with the legacy
per-event interface.


Changes since v1 [1]:
 - Clarified that all events with filters are listed, regardless of
   enablement state (Steven Rostedt)
 - Optimise filter display logic by utilising the guard(rcu) macro for cleaner 
   scope-based RCU protection and early return (Steven Rostedt)
 - Add show_event_triggers to expose event triggers alongside filters
   (Steven Rostedt)

[1]: https://lore.kernel.org/lkml/20260101233414.2476973-1-atomlin@atomlin.com/

Aaron Tomlin (2):
  tracing: Add show_event_filters to expose active event filters
  tracing: Add show_event_triggers to expose active event triggers

 Documentation/trace/ftrace.rst |  16 +++++
 kernel/trace/trace_events.c    | 122 +++++++++++++++++++++++++++++++++
 2 files changed, 138 insertions(+)

-- 
2.51.0

[v2 PATCH 1/2] tracing: Add show_event_filters to expose active event filters

[Aaron Tomlin]

Currently, to audit active Ftrace event filters, userspace must
recursively traverse the events/ directory and read each individual
filter file. This is inefficient for monitoring tools and debugging.

Introduce "show_event_filters" at the trace root directory. This file
displays all events that currently have a filter applied, alongside the
actual filter string, in a consolidated system:event [tab] filter
format.

The implementation reuses the existing trace_event_file iterators to
ensure atomic traversal of the event list and utilises guard(rcu)() for
automatic, scope-based protection when accessing volatile filter
strings.

Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
 Documentation/trace/ftrace.rst |  8 +++++
 kernel/trace/trace_events.c    | 58 ++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)

diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst
index 639f4d95732f..4ce01e726b09 100644
--- a/Documentation/trace/ftrace.rst
+++ b/Documentation/trace/ftrace.rst
@@ -684,6 +684,14 @@ of ftrace. Here is a list of some of the key files:
 
 	See events.rst for more information.
 
+  show_event_filters:
+
+	A list of events that have filters. This shows the
+	system/event pair along with the filter that is attached to
+	the event.
+
+	See events.rst for more information.
+
   available_events:
 
 	A list of events that can be enabled in tracing.
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index b16a5a158040..5ede4214c4df 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1661,6 +1661,32 @@ static void t_stop(struct seq_file *m, void *p)
 	mutex_unlock(&event_mutex);
 }
 
+/**
+ * t_show_filters - seq_file callback to display active event filters
+ * @m: The seq_file interface for formatted output
+ * @v: The current trace_event_file being iterated
+ *
+ * Identifies and prints active filters for the current event file in the
+ * iteration. If a filter is applied to the current event and, if so,
+ * prints the system name, event name, and the filter string.
+ */
+static int t_show_filters(struct seq_file *m, void *v)
+{
+	struct trace_event_file *file = v;
+	struct trace_event_call *call = file->event_call;
+	struct event_filter *filter;
+
+	guard(rcu)();
+	filter = rcu_dereference(file->filter);
+	if (!filter || !filter->filter_string)
+		return 0;
+
+	seq_printf(m, "%s:%s\t%s\n", call->class->system,
+		   trace_event_name(call), filter->filter_string);
+
+	return 0;
+}
+
 #ifdef CONFIG_MODULES
 static int s_show(struct seq_file *m, void *v)
 {
@@ -2488,6 +2514,7 @@ ftrace_event_npid_write(struct file *filp, const char __user *ubuf,
 
 static int ftrace_event_avail_open(struct inode *inode, struct file *file);
 static int ftrace_event_set_open(struct inode *inode, struct file *file);
+static int ftrace_event_show_filters_open(struct inode *inode, struct file *file);
 static int ftrace_event_set_pid_open(struct inode *inode, struct file *file);
 static int ftrace_event_set_npid_open(struct inode *inode, struct file *file);
 static int ftrace_event_release(struct inode *inode, struct file *file);
@@ -2506,6 +2533,13 @@ static const struct seq_operations show_set_event_seq_ops = {
 	.stop = s_stop,
 };
 
+static const struct seq_operations show_show_event_filters_seq_ops = {
+	.start = t_start,
+	.next = t_next,
+	.show = t_show_filters,
+	.stop = t_stop,
+};
+
 static const struct seq_operations show_set_pid_seq_ops = {
 	.start = p_start,
 	.next = p_next,
@@ -2535,6 +2569,13 @@ static const struct file_operations ftrace_set_event_fops = {
 	.release = ftrace_event_release,
 };
 
+static const struct file_operations ftrace_show_event_filters_fops = {
+	.open = ftrace_event_show_filters_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = seq_release,
+};
+
 static const struct file_operations ftrace_set_event_pid_fops = {
 	.open = ftrace_event_set_pid_open,
 	.read = seq_read,
@@ -2679,6 +2720,20 @@ ftrace_event_set_open(struct inode *inode, struct file *file)
 	return ret;
 }
 
+/**
+ * ftrace_event_show_filters_open - open interface for set_event_filters
+ * @inode: The inode of the file
+ * @file: The file being opened
+ *
+ * Connects the set_event_filters file to the sequence operations
+ * required to iterate over and display active event filters.
+ */
+static int
+ftrace_event_show_filters_open(struct inode *inode, struct file *file)
+{
+	return ftrace_event_open(inode, file, &show_show_event_filters_seq_ops);
+}
+
 static int
 ftrace_event_set_pid_open(struct inode *inode, struct file *file)
 {
@@ -4399,6 +4454,9 @@ create_event_toplevel_files(struct dentry *parent, struct trace_array *tr)
 	if (!entry)
 		return -ENOMEM;
 
+	trace_create_file("show_event_filters", TRACE_MODE_READ, parent, tr,
+			  &ftrace_show_event_filters_fops);
+
 	nr_entries = ARRAY_SIZE(events_entries);
 
 	e_events = eventfs_create_events_dir("events", parent, events_entries,
-- 
2.51.0

[v2 PATCH 2/2] tracing: Add show_event_triggers to expose active event triggers

[Aaron Tomlin]

To audit active event triggers, userspace currently must traverse the
events/ directory and read each individual trigger file. This is
cumbersome for system-wide auditing or debugging.

Introduce "show_event_triggers" at the trace root directory. This file
displays all events that currently have one or more triggers applied,
alongside the trigger configuration, in a consolidated
system:event [tab] trigger format.

The implementation leverages the existing trace_event_file iterators
and uses the trigger's own print() operation to ensure output
consistency with the per-event trigger files.

Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
 Documentation/trace/ftrace.rst |  8 +++++
 kernel/trace/trace_events.c    | 64 ++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)

diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst
index 4ce01e726b09..b9efb148a5c2 100644
--- a/Documentation/trace/ftrace.rst
+++ b/Documentation/trace/ftrace.rst
@@ -692,6 +692,14 @@ of ftrace. Here is a list of some of the key files:
 
 	See events.rst for more information.
 
+  show_event_triggers:
+
+	A list of events that have triggers. This shows the
+	system/event pair along with the trigger that is attached to
+	the event.
+
+	See events.rst for more information.
+
   available_events:
 
 	A list of events that can be enabled in tracing.
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 5ede4214c4df..e2a67561253d 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1687,6 +1687,38 @@ static int t_show_filters(struct seq_file *m, void *v)
 	return 0;
 }
 
+/**
+ * t_show_triggers - seq_file callback to display active event triggers
+ * @m: The seq_file interface for formatted output
+ * @v: The current trace_event_file being iterated
+ *
+ * Iterates through the trigger list of the current event file and prints
+ * each active trigger's configuration using its associated print
+ * operation.
+ */
+static int t_show_triggers(struct seq_file *m, void *v)
+{
+	struct trace_event_file *file = v;
+	struct trace_event_call *call = file->event_call;
+	struct event_trigger_data *data;
+
+	/*
+	 * The event_mutex is held by t_start(), protecting the
+	 * file->triggers list traversal.
+	 */
+	if (list_empty(&file->triggers))
+		return 0;
+
+	list_for_each_entry_rcu(data, &file->triggers, list) {
+		seq_printf(m, "%s:%s\t", call->class->system,
+			   trace_event_name(call));
+
+		data->cmd_ops->print(m, data);
+	}
+
+	return 0;
+}
+
 #ifdef CONFIG_MODULES
 static int s_show(struct seq_file *m, void *v)
 {
@@ -2515,6 +2547,7 @@ ftrace_event_npid_write(struct file *filp, const char __user *ubuf,
 static int ftrace_event_avail_open(struct inode *inode, struct file *file);
 static int ftrace_event_set_open(struct inode *inode, struct file *file);
 static int ftrace_event_show_filters_open(struct inode *inode, struct file *file);
+static int ftrace_event_show_triggers_open(struct inode *inode, struct file *file);
 static int ftrace_event_set_pid_open(struct inode *inode, struct file *file);
 static int ftrace_event_set_npid_open(struct inode *inode, struct file *file);
 static int ftrace_event_release(struct inode *inode, struct file *file);
@@ -2540,6 +2573,13 @@ static const struct seq_operations show_show_event_filters_seq_ops = {
 	.stop = t_stop,
 };
 
+static const struct seq_operations show_show_event_triggers_seq_ops = {
+	.start = t_start,
+	.next = t_next,
+	.show = t_show_triggers,
+	.stop = t_stop,
+};
+
 static const struct seq_operations show_set_pid_seq_ops = {
 	.start = p_start,
 	.next = p_next,
@@ -2576,6 +2616,13 @@ static const struct file_operations ftrace_show_event_filters_fops = {
 	.release = seq_release,
 };
 
+static const struct file_operations ftrace_show_event_triggers_fops = {
+	.open = ftrace_event_show_triggers_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = seq_release,
+};
+
 static const struct file_operations ftrace_set_event_pid_fops = {
 	.open = ftrace_event_set_pid_open,
 	.read = seq_read,
@@ -2734,6 +2781,20 @@ ftrace_event_show_filters_open(struct inode *inode, struct file *file)
 	return ftrace_event_open(inode, file, &show_show_event_filters_seq_ops);
 }
 
+/**
+ * ftrace_event_show_triggers_open - open interface for show_event_triggers
+ * @inode: The inode of the file
+ * @file: The file being opened
+ *
+ * Connects the show_event_triggers file to the sequence operations
+ * required to iterate over and display active event triggers.
+ */
+static int
+ftrace_event_show_triggers_open(struct inode *inode, struct file *file)
+{
+	return ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops);
+}
+
 static int
 ftrace_event_set_pid_open(struct inode *inode, struct file *file)
 {
@@ -4457,6 +4518,9 @@ create_event_toplevel_files(struct dentry *parent, struct trace_array *tr)
 	trace_create_file("show_event_filters", TRACE_MODE_READ, parent, tr,
 			  &ftrace_show_event_filters_fops);
 
+	trace_create_file("show_event_triggers", TRACE_MODE_READ, parent, tr,
+			  &ftrace_show_event_triggers_fops);
+
 	nr_entries = ARRAY_SIZE(events_entries);
 
 	e_events = eventfs_create_events_dir("events", parent, events_entries,
-- 
2.51.0

Re: [v2 PATCH 2/2] tracing: Add show_event_triggers to expose active event triggers

[Randy Dunlap]

Hi,

On 1/5/26 6:29 AM, Aaron Tomlin wrote:
> diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst
> index 4ce01e726b09..b9efb148a5c2 100644
> --- a/Documentation/trace/ftrace.rst
> +++ b/Documentation/trace/ftrace.rst
> @@ -692,6 +692,14 @@ of ftrace. Here is a list of some of the key files:
>  
>  	See events.rst for more information.
>  
> +  show_event_triggers:
> +
> +	A list of events that have triggers. This shows the
> +	system/event pair along with the trigger that is attached to
> +	the event.
> +
> +	See events.rst for more information.
> +

Isn't this the same chunk that was in patch 1/2?

>    available_events:
>  
>  	A list of events that can be enabled in tracing.

-- 
~Randy

Re: [v2 PATCH 2/2] tracing: Add show_event_triggers to expose active event triggers

[Steven Rostedt]

On Mon, 5 Jan 2026 22:10:39 -0800
Randy Dunlap <rdunlap@infradead.org> wrote:

> Hi,
> 
> On 1/5/26 6:29 AM, Aaron Tomlin wrote:
> > diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst
> > index 4ce01e726b09..b9efb148a5c2 100644
> > --- a/Documentation/trace/ftrace.rst
> > +++ b/Documentation/trace/ftrace.rst
> > @@ -692,6 +692,14 @@ of ftrace. Here is a list of some of the key files:
> >  
> >  	See events.rst for more information.
> >  
> > +  show_event_triggers:
> > +
> > +	A list of events that have triggers. This shows the
> > +	system/event pair along with the trigger that is attached to
> > +	the event.
> > +
> > +	See events.rst for more information.
> > +  
> 
> Isn't this the same chunk that was in patch 1/2?

No, patch 1/2 has:

@@ -684,6 +684,14 @@ of ftrace. Here is a list of some of the key files:
 
 	See events.rst for more information.
 
+  show_event_filters:
+
+	A list of events that have filters. This shows the
+	system/event pair along with the filter that is attached to
+	the event.
+
+	See events.rst for more information.
+
   available_events:


It is simply a s/filter/trigger/g difference though.

-- Steve

Re: [v2 PATCH 2/2] tracing: Add show_event_triggers to expose active event triggers

[Randy Dunlap]

On 1/6/26 7:17 AM, Steven Rostedt wrote:
> On Mon, 5 Jan 2026 22:10:39 -0800
> Randy Dunlap <rdunlap@infradead.org> wrote:
> 
>> Hi,
>>
>> On 1/5/26 6:29 AM, Aaron Tomlin wrote:
>>> diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst
>>> index 4ce01e726b09..b9efb148a5c2 100644
>>> --- a/Documentation/trace/ftrace.rst
>>> +++ b/Documentation/trace/ftrace.rst
>>> @@ -692,6 +692,14 @@ of ftrace. Here is a list of some of the key files:
>>>  
>>>  	See events.rst for more information.
>>>  
>>> +  show_event_triggers:
>>> +
>>> +	A list of events that have triggers. This shows the
>>> +	system/event pair along with the trigger that is attached to
>>> +	the event.
>>> +
>>> +	See events.rst for more information.
>>> +  
>>
>> Isn't this the same chunk that was in patch 1/2?
> 
> No, patch 1/2 has:
> 
> @@ -684,6 +684,14 @@ of ftrace. Here is a list of some of the key files:
>  
>  	See events.rst for more information.
>  
> +  show_event_filters:
> +
> +	A list of events that have filters. This shows the
> +	system/event pair along with the filter that is attached to
> +	the event.
> +
> +	See events.rst for more information.
> +
>    available_events:
> 
> 
> It is simply a s/filter/trigger/g difference though.

Ack. Thanks.

-- 
~Randy

Re: [v2 PATCH 2/2] tracing: Add show_event_triggers to expose active event triggers

[Aaron Tomlin]

[-- Attachment #1: Type: text/plain, Size: 240 bytes --]

On Tue, Jan 06, 2026 at 08:08:17AM -0800, Randy Dunlap wrote:
> > It is simply a s/filter/trigger/g difference though.
> 
> Ack. Thanks.

Hi Randy,

Sorry about the delay. Indeed, as per Steve.


Kind regards,
-- 
Aaron Tomlin

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]