I''m working on a DTrace script to measure the performance impact of auditing in the kernel, and have run into a problem: Right now I take a vtimestamp at fbt:c2audit:audit_start:entry and fbt:c2audit:audit_start:return plus fbt:c2audit:audit_finish:entry and fbt:c2audit:audit_finish:return, then I can calculate the time spent executing the audit code. But: the c2audit module, if loaded, sets t_pre_sys and t_post_sys on klwp_t and therefore pre_syscall() and post_syscall() are executed (and audit_start/finish). By measuring only audit_start/finish I miss what else is executed in pre/post syscall hooks. Because dtrace uses those hooks as well I get a split-brain situation - how to measure impact of pre/post syscall hooks if the measuring method uses them... Any suggestions on how to work around this? cheers, /Martin -- This message posted from opensolaris.org
I''ll answer my own thread for the sake of documentation :) It seems I was mislead to think that DTrace used the pre_syscall() & post_syscall() so there is no issue. cheers, /Martin -- This message posted from opensolaris.org
Do keep us informed as to the results, I know it is slightly off topic for this mailing list, but it would be interesting to see what impast enabling auditing has on the system. James Dickens uadmin.blogspot.com On 8/20/07, Martin Englund <martin.englund at sun.com> wrote:> > I''ll answer my own thread for the sake of documentation :) > > It seems I was mislead to think that DTrace used the pre_syscall() & > post_syscall() so there is no issue. > > cheers, > /Martin > > > -- > This message posted from opensolaris.org > _______________________________________________ > dtrace-discuss mailing list > dtrace-discuss at opensolaris.org >-------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mail.opensolaris.org/pipermail/dtrace-discuss/attachments/20070823/4161b200/attachment.html>