Pf tracing susbsystem is a debugging and analysis tool that can be used to unveil problems with real-time characteristics of the code being analyzed.

Pf consists of a system-wide kenrel-mode buffer which holds traced events, several hooks in the kernel for common events (e.g., interrupts), a userspace library that allows user-mode programs to put messages directly into the kernel-mode event buffer, "pfctl" console control utility, and "gauntlet" GUI application for analyzing tracing results.

Pf is meant to be simple, yet powerfull. Maintenance such custom debugging tool allows for great flexibility in choosing debugging methods and representation of collected data.

Currently Pf is in a morphing state, adopting from one debugging task to another. It could well become a separate project, but there's just not enough man-power to hack on it at the moment.

Below you can see some screenshots of Pf.gauntlet GUI tool in action, with links to related dev-blog posts.