Audit issue
Steve Grubb
sgrubb at redhat.com
Fri Nov 9 00:28:07 UTC 2007
On Thursday 08 November 2007 09:59:30 Steve Grubb wrote:
> On Thursday 08 November 2007 09:56:51 Alexander Viro wrote:
> > Easy enough to test - boot with audit disabled, run benchmarks, enable
> > it, flush all caches (e.g. by memory pressure), rerun the benchmarks,
> > compare... I don't think it will be serious problem, but if it will
> > we can always look for trickier solutions.
>
> OK. I'll try to build a kernel and check this out. Might have some results
> later.
OK, had a chance to do testing. First, the patch works. It solves the problem
that was reported. Here's some performance numbers using the performance test
I have at http://people.redhat.com/sgrubb/files/lspp-perf.tar.gz
without patch boot with audit=0
audit disabled: 38.9
audit enabled: 42.3
without patch boot with audit=1
audit disabled: 41.4
audit enabled: 42.9
with patch boot with audit=0
audit disabled: 38.6
audit enabled: 43.8
with patch boot with audit=1
audit disabled: 44.2
audit enabled: 44.6
So, when audit is enabled at boot. There is virtually no performance
difference between enabled and not. The old way, we had a 4% performance
improvement when audit was disabled. Looking at the audit=0 case, there is
about a 3.5% performance hit when audit is enabled with the new patch. The
old way, audit disabled was always significantly faster ~ %4. With the patch
its only about 1% faster.
-Steve
More information about the Linux-audit
mailing list