{
  "schema_version": "0.1.0",
  "record_type": "research-topic",
  "topic_id": "lttng",
  "label": "LTTng",
  "title": "LTTng Tracing Research",
  "description": "Research papers using LTTng or LTTng-UST for kernel, user-space, cloud, and performance tracing.",
  "introduction": "This topic collects papers in the catalog that explicitly use LTTng or LTTng-UST for operating-system, user-space, container, cloud, or application tracing. The linked records describe the instrumentation scope, trace events, CTF or decoding pipeline, workloads, and tracing overhead only where those details are supported by the source evidence.",
  "aliases": [
    "LTTng tracing",
    "LTTng-UST",
    "Linux Trace Toolkit next generation"
  ],
  "search_terms": [
    "LTTng",
    "LTTng-UST",
    "kernel tracepoints",
    "CTF tracing",
    "Babeltrace"
  ],
  "related_topics": [
    "kernel-tracing",
    "system-tracing",
    "trace-analysis",
    "trace-filtering",
    "observability"
  ],
  "canonical_url": "https://threadslab.org/research-publications/topics/lttng.html",
  "paper_count": 7,
  "papers": [
    {
      "paper_id": "dtracomp-distributed-trace-comparison",
      "title": "DTraComp: Comparing distributed execution traces for understanding intermittent latency sources",
      "year": 2026,
      "authors": [
        "Maryam Ekhlasi",
        "Fatemeh Faraji Daneshgar",
        "Michel Dagenais",
        "Maxime Lamothe",
        "Naser Ezzati-Jivan",
        "Matthew Khouzam"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/dtracomp-distributed-trace-comparison/",
      "canonical_source_url": "https://doi.org/10.1016/j.jss.2026.112990",
      "core_contribution": "DTraComp is an open-source Eclipse Trace Compass framework that compares groups of distributed requests and attributes span time to user-space, kernel, thread-state, and system-call evidence.",
      "tags": [
        "system-tracing",
        "kernel-tracing",
        "trace-analysis",
        "trace-visualization",
        "latency-analysis",
        "root-cause-analysis",
        "microservices",
        "lttng"
      ],
      "keywords": [
        "DTraComp",
        "distributed trace comparison",
        "OpenTracing",
        "LTTng",
        "LTTng-UST",
        "Eclipse Trace Compass",
        "differential flame graph",
        "span-state attribution",
        "system-call attribution",
        "Waited CPU",
        "Waited Blocked",
        "HotROD",
        "TiDB",
        "Apache Cassandra",
        "Eclipse Theia",
        "JFreeChart",
        "Jaeger",
        "microservice performance"
      ]
    },
    {
      "paper_id": "execution-trace-model-verification-multicore",
      "title": "Execution trace-based model verification to analyze multicore and real-time systems",
      "year": 2022,
      "authors": [
        "Raphaël Beamonte",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/execution-trace-model-verification-multicore/",
      "canonical_source_url": "https://doi.org/10.1002/cpe.6974",
      "core_contribution": "The paper combines model-based quantitative constraints with user-space and kernel execution traces to automatically identify likely causes of real-time and multicore constraint violations.",
      "tags": [
        "system-tracing",
        "kernel-tracing",
        "multicore-systems",
        "trace-analysis",
        "root-cause-analysis",
        "lttng"
      ],
      "keywords": [
        "model-based constraints",
        "execution tracing",
        "user-space traces",
        "kernel traces",
        "LTTng",
        "LTTng-UST",
        "Common Trace Format",
        "Trace Compass",
        "reservoir sampling",
        "critical-path analysis",
        "JACK2",
        "cyclictest",
        "priority inversion",
        "CPUTop"
      ]
    },
    {
      "paper_id": "model-based-constraints-execution-tracing",
      "title": "Automated Generation of Model-Based Constraints for Common Multi-core and Real-Time Applications Using Execution Tracing",
      "year": 2021,
      "authors": [
        "Raphael Beamonte",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/model-based-constraints-execution-tracing/",
      "canonical_source_url": "https://doi.org/10.1007/s10766-020-00689-5",
      "core_contribution": "The paper automatically builds an approximate workflow model and adaptive quantitative constraints from user-space and kernel execution traces, reducing manual model construction for real-time and multicore diagnosis.",
      "tags": [
        "system-tracing",
        "multicore-systems",
        "trace-analysis",
        "performance-analysis",
        "lttng"
      ],
      "keywords": [
        "model-based constraints",
        "execution tracing",
        "multi-core systems",
        "real-time applications",
        "constraint generation",
        "LTTng",
        "Trace Compass",
        "cyclictest",
        "JACK2",
        "wakelock"
      ]
    },
    {
      "paper_id": "combining-distributed-kernel-tracing-cloud",
      "title": "Combining Distributed and Kernel Tracing for Performance Analysis of Cloud Applications",
      "year": 2021,
      "authors": [
        "Loïc Gelle",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/combining-distributed-kernel-tracing-cloud/",
      "canonical_source_url": "https://doi.org/10.3390/electronics10212610",
      "core_contribution": "The paper combines Jaeger distributed traces with LTTng kernel and user-space events and extends critical-path analysis from threads to distributed requests so request latency can be related to low-level scheduling and resource behavior.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "observability",
        "lttng"
      ],
      "keywords": [
        "distributed tracing",
        "kernel tracing",
        "cloud applications",
        "cross-layer performance analysis",
        "LTTng",
        "Jaeger",
        "Trace Compass",
        "Babeltrace",
        "Common Trace Format",
        "HotROD",
        "Cassandra",
        "Apache ab",
        "cassandra-stress",
        "critical-path analysis",
        "snapshot tracing",
        "CPU control groups",
        "liblttng-ust",
        "request synchronization"
      ]
    },
    {
      "paper_id": "enhanced-trace-abstraction-social-network-analysis",
      "title": "Enhanced Execution Trace Abstraction Approach Using Social Network Analysis Methods",
      "year": 2020,
      "authors": [
        "Ji Wang",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/enhanced-trace-abstraction-social-network-analysis/",
      "canonical_source_url": "https://fb-swt.gi.de/fileadmin/FB/SWT/Softwaretechnik-Trends/Verzeichnis/Band_40_Heft_3/SSP2020_Wang.pdf",
      "core_contribution": "The paper adapts community detection and PageRank from social-network analysis to reduce and prioritize system execution traces.",
      "tags": [
        "kernel-tracing",
        "trace-abstraction",
        "social-network-analysis",
        "trace-filtering",
        "lttng"
      ],
      "keywords": [
        "LTTng",
        "Trace Compass",
        "Louvain community detection",
        "PageRank",
        "thread interaction graph",
        "trace filtering",
        "virtual-machine clustering"
      ]
    },
    {
      "paper_id": "multi-level-host-based-intrusion-detection-system-for-internet-of-things",
      "title": "Multi-level Host-based Intrusion Detection System for Internet of Things",
      "year": 2020,
      "authors": [
        "Robin Gassais",
        "Naser Ezzati-Jivan",
        "Jose M. Fernandez",
        "Daniel Aloise",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/multi-level-host-based-intrusion-detection-system-for-internet-of-things/",
      "canonical_source_url": "https://doi.org/10.1186/s13677-020-00206-6",
      "core_contribution": "The paper combines host-level user/kernel tracing with machine learning to detect intrusion behavior on constrained IoT and home-automation systems.",
      "tags": [
        "iot-security",
        "kernel-tracing",
        "machine-learning",
        "anomaly-detection",
        "lttng",
        "observability"
      ],
      "keywords": [
        "IoT intrusion detection",
        "host-based IDS",
        "LTTng",
        "barectf",
        "Common Trace Format",
        "Babeltrace",
        "Raspberry Pi 3",
        "Home Assistant",
        "Decision Tree",
        "Random Forest",
        "Gradient Boosted Trees",
        "SVM",
        "MLP",
        "LSTM",
        "Mirai",
        "ransomware",
        "CPU overhead",
        "memory overhead"
      ]
    },
    {
      "paper_id": "efficient-analysis-multi-core-system-tracing-data",
      "title": "An Efficient Analysis Approach for Multi-Core System Tracing Data",
      "year": 2012,
      "authors": [
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/efficient-analysis-multi-core-system-tracing-data/",
      "canonical_source_url": "https://doi.org/10.2316/P.2012.790-053",
      "core_contribution": "The paper introduces a stateful trace-abstraction architecture that shares modeled system state and intermediate computation across concurrent patterns to reduce the cost of analyzing large Linux kernel traces.",
      "tags": [
        "kernel-tracing",
        "lttng",
        "trace-analysis",
        "trace-abstraction",
        "trace-filtering",
        "performance-analysis",
        "multicore-systems"
      ],
      "keywords": [
        "multi-core tracing",
        "LTTng",
        "Linux kernel 2.6.38.6",
        "stateful trace analysis",
        "trace abstraction",
        "EventMapper",
        "modeled state",
        "semantic events",
        "synthetic event generation",
        "State Machine Language",
        "pattern library",
        "partial trace abstraction",
        "SYN flood",
        "fork bomb",
        "kernel trace",
        "Java trace analyzer",
        "computation sharing",
        "storage efficiency"
      ]
    }
  ]
}