RE: [Announce] Non Invasive Kernel Monitor for threads/processes
From: Sabharwal, Atul (atul.sabharwal_at_intel.com)
Date: 06/16/04
- Previous message: Sturle Sunde: "[PATCH] atime on devices"
- Maybe in reply to: Atul Sabharwal: "[Announce] Non Invasive Kernel Monitor for threads/processes"
- Next in thread: Chris Wright: "Re: [Announce] Non Invasive Kernel Monitor for threads/processes"
- Reply: Chris Wright: "Re: [Announce] Non Invasive Kernel Monitor for threads/processes"
- Reply: Chris Friesen: "Re: [Announce] Non Invasive Kernel Monitor for threads/processes"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Tue, 15 Jun 2004 17:54:40 -0700 To: "Chris Wright" <chrisw@osdl.org>
>* Atul Sabharwal (atul_sabharwal@linux.jf.intel.com) wrote:
>> We have been working with a solution for non-intrusively
>trapping on lifetime
>> of processes/threads. This is useful for management
>applications running in
>> telecom and enterprise data centers that need to monitor a
>set of threads/
>> processes.
>>
>> Project Goal::
>> ~~~~~~~~~~~~~~
>> To create a kernel patch that shall support methods to
>non-intrusively monitor
>> processes/threads at the kernel level. It would use a
>notfication mechanism in
>> the kernel that allows registration of events of interest
>regarding processes/
>> threads. Events of interest could be the following :
>Process creation (fork),
>> Process exit(exit), Process calls(exec), thread creation &
>thread exit.
>
>These spots are already hooked via LSM and audit (the latter is capable
>of communicating such events to userspace via netfilter) Was that not
>sufficient somehow? In fact, the netfilter queuing will probably fair
>better than sigqueue which fairly limited. Might be worth looking into
>that. Did you look at the task ornament patch floating about
>from David
>Howells? If new code is needed, that patch looks more
>generically useful.
>
How does auditing work in the event of a process failure ? There would
be
no system call triggered in that case. Also, my initial thoughts are
that the non-invasive Kmonitor is lesser performance impact when
compared
to auditing. I would spend some time developing sample code to confirm
it.
I have not looked at the task ornament patch. If you could send me a
link.
Thanks,
Atul
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
- Previous message: Sturle Sunde: "[PATCH] atime on devices"
- Maybe in reply to: Atul Sabharwal: "[Announce] Non Invasive Kernel Monitor for threads/processes"
- Next in thread: Chris Wright: "Re: [Announce] Non Invasive Kernel Monitor for threads/processes"
- Reply: Chris Wright: "Re: [Announce] Non Invasive Kernel Monitor for threads/processes"
- Reply: Chris Friesen: "Re: [Announce] Non Invasive Kernel Monitor for threads/processes"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
