audit 1.2.2 released

Steve Grubb sgrubb at redhat.com
Tue May 23 15:11:59 UTC 2006


On Monday 22 May 2006 23:43, Xin Zhao wrote:
> Now I have to move to next question: can auditd record how much time
> each system call uses.

No. Its view of the world is very much like strace's. I think for that you are 
better off looking at system-tap or oprofile:

http://sources.redhat.com/systemtap/documentation.html

> I am developing a file system and might want to monitor all file system
> related system call to find the performance bottleneck in my system.

I have a feeling that system tap may be a better fit for your project. You can 
certainly monitor all files or extend the audit system to give you time hacks 
via an auxiliary record, but that was never its intended use.

Also look at oprofile:
http://oprofile.sourceforge.net/about/

-Steve




More information about the Linux-audit mailing list