Perfromance issues

Timothy R. Chavez tinytim at us.ibm.com
Thu Sep 8 18:58:24 UTC 2005


On Thursday 08 September 2005 13:21, Chris Wright wrote:
> * Steve Grubb (sgrubb at redhat.com) wrote:
> > On Thursday 08 September 2005 13:28, Chris Wright wrote:
> > > Any micro optimisation needs to be benchmarked to show whether it's really
> > > useful (I'd expect this one to be in the noise even though assembly
> > > inspection should show improvement).
> > 
> > I think we have to start thinking about this. People are comparing system 
> > performance with audit disabled and enabled and not compiled in at all. The 
> > hit is significant. We need to see what can be done to make it better.
> 
> Absolutely agreed.  Profiles would be quite helpful here.
> 
> > > IMO, a better choice would be a static inline stub to keep from cluttering
> > > call sites.  Smth. like: 
> > 
> > I like this. Easy to contain the changes without a big change to any patch. 
> > But just to be sure, I'm not talking only about the one case I posted. 
> > syscall_entry & exit are a bigger hit as it affects all syscalls.
> 
> Yup, generic change that potentially improves every call site.

This stradegy will fall in line with using fsnotify hooks.

> 
> thanks,
> -chris
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> http://www.redhat.com/mailman/listinfo/linux-audit
> 
> 




More information about the Linux-audit mailing list