Give me 15 minutes and I'll change your view of Linux tracing [video]
Argh.  This talk reinforced my existing view of Linux tracing: it's really fragmented.<p>Five years ago I tried to make some sense of this by researching all of the existing technologies.  In the kernel I found:<p><pre><code>   - ftrace (https://lwn.net/Articles/290277/)
   - tracepoints (https://www.kernel.org/doc/Documentation/trace/tracepoints.txt)
   - kprobes (https://www.kernel.org/doc/Documentation/kprobes.txt)
   - events (https://www.kernel.org/doc/Documentation/trace/events.txt)
</code></pre>
Now apparently we can add:<p><pre><code>   - BPF, a packet filter that grew into a tracing framework
     (https://lwn.net/Articles/599755/)
</code></pre>
In user-space we have:<p><pre><code>   - perf
   - systemtap
   - lttng
   - other, random, fragmented things
</code></pre>
This talk seems to add a bunch of other fragmented user-space tools.<p>I don't mean to put down anybody's work, but this stuff will never be user-friendly as long as it remains so fragmented, IMHO.