6 files changed, 126 insertions, 0 deletions
diff --git a/src/trace_profile/README.md b/src/trace_profile/README.md
new file mode 100644
index 0000000..69d120b
--- /dev/null
+++ b/src/trace_profile/README.md
@@ -0,0 +1 @@
+# Trace and Profile
diff --git a/src/trace_profile/ltrace.md b/src/trace_profile/ltrace.md
new file mode 100644
index 0000000..cfa3fae
--- /dev/null
+++ b/src/trace_profile/ltrace.md
@@ -0,0 +1,17 @@
+# ltrace(1)
+
+```markdown
+ltrace [opts] [prg]
+  -f .......... follow child processes on fork(2)
+  -p <pid> .... attach to running process
+  -o <file> ... log output into <file>
+  -l <filter> . show who calls into lib matched by <filter>
+  -C .......... demangle
+```
+
+# Example
+
+List which program/libs call into `libstdc++`:
+```bash
+ltrace -l '*libstdc++*' -C -o ltrace.log ./main
+```
diff --git a/src/trace_profile/oprofile.md b/src/trace_profile/oprofile.md
new file mode 100644
index 0000000..7d35283
--- /dev/null
+++ b/src/trace_profile/oprofile.md
@@ -0,0 +1,14 @@
+# [OProfile](https://oprofile.sourceforge.io/)
+
+```markdown
+operf -g -p <pid>
+  -g ...... caputre call-graph information
+
+opreport [opt] FILE
+            show time spent per binary image
+  -l ...... show time spent per symbol
+  -c ...... show callgraph information (see below)
+  -a ...... add column with time spent accumulated over child nodes
+
+ophelp      show supported hw/sw events
+```
diff --git a/src/trace_profile/perf.md b/src/trace_profile/perf.md
new file mode 100644
index 0000000..57118ed
--- /dev/null
+++ b/src/trace_profile/perf.md
@@ -0,0 +1,56 @@
+# perf(1)
+
+```markdown
+perf list      show supported hw/sw events
+
+perf stat
+  -p <pid> .. show stats for running process
+  -I <ms> ... show stats periodically over interval <ms>
+  -e <ev> ... filter for events
+
+perf top
+  -p <pid> .. show stats for running process
+  -F <hz> ... sampling frequency
+  -K ........ hide kernel threads
+
+perf record
+  -p <pid> ............... record stats for running process
+  -F <hz> ................ sampling frequency
+  --call-graph <method> .. [fp, dwarf, lbr] method how to caputre backtrace
+                           fp   : use frame-pointer, need to compile with
+                                  -fno-omit-frame-pointer
+                           dwarf: use .cfi debug information
+                           lbr  : use hardware last branch record facility
+  -g ..................... short-hand for --call-graph fp
+  -e <ev> ................ filter for events
+
+perf report
+  -n .................... annotate symbols with nr of samples
+  --stdio ............... report to stdio, if not presen tui mode
+  -g graph,0.5,caller ... show caller based call chains with value >0.5
+```
+
+```markdown
+Useful <ev>:
+  page-faults
+  minor-faults
+  major-faults
+  cpu-cycles`
+  task-clock
+```
+
+## [`Flamegraph`](https://github.com/brendangregg/FlameGraph)
+
+### Flamegraph with single event trace
+```markdown
+perf record -g -e cpu-cycles -p <pid>
+perf script | FlameGraph/stackcollapse-perf.pl | FlameGraph/flamegraph.pl > cycles-flamegraph.svg
+```
+
+### Flamegraph with multiple event traces
+```markdown
+perf record -g -e cpu-cycles,page-faults -p <pid>
+perf script --per-event-dump
+# fold & generate as above
+```
+
diff --git a/src/trace_profile/strace.md b/src/trace_profile/strace.md
new file mode 100644
index 0000000..34abf3b
--- /dev/null
+++ b/src/trace_profile/strace.md
@@ -0,0 +1,32 @@
+# strace(1)
+
+```markdown
+strace [opts] [prg]
+  -f .......... follow child processes on fork(2)
+  -p <pid> .... attach to running process
+  -s <size> ... max string size, truncate of longer (default: 32)
+  -e <expr> ... expression for trace filtering
+  -o <file> ... log output into <file>
+  -c .......... dump syscall statitics at the end
+```
+
+```markdown
+<expr>:
+  trace=syscall[,syscall] .... trace only syscall listed
+  trace=file ................. trace all syscall that take a filename as arg
+  trace=process .............. trace process management related syscalls
+  trace=signal ............... trace signal related syscalls
+  signal ..................... trace signals delivered to the process
+```
+
+# Examples
+
+Trace `open(2)` & `socket(2)` syscalls for a running process + child processes:
+```markdown
+strace -f -e trace=open,socket -p <pid>
+```
+
+Trace signals delivered to a running process:
+```markdown
+strace -f -e signal -p <pid>
+```
diff --git a/src/trace_profile/time.md b/src/trace_profile/time.md
new file mode 100644
index 0000000..be404fb
--- /dev/null
+++ b/src/trace_profile/time.md
@@ -0,0 +1,6 @@
+# /usr/bin/time(1)
+
+```markdown
+# statistics of process run
+/usr/bin/time -v <cmd>
+```