Audit issue

Steve Grubb sgrubb at redhat.com
Fri Nov 9 00:28:07 UTC 2007


On Thursday 08 November 2007 09:59:30 Steve Grubb wrote:
> On Thursday 08 November 2007 09:56:51 Alexander Viro wrote:
> > Easy enough to test - boot with audit disabled, run benchmarks, enable
> > it, flush all caches (e.g. by memory pressure), rerun the benchmarks,
> > compare...  I don't think it will be serious problem, but if it will
> > we can always look for trickier solutions.
>
> OK. I'll try to build a kernel and check this out. Might have some results
> later.

OK, had a chance to do testing. First, the patch works. It solves the problem 
that was reported. Here's some performance numbers using the performance test 
I have at http://people.redhat.com/sgrubb/files/lspp-perf.tar.gz

without patch boot with audit=0
audit disabled: 38.9
audit enabled:  42.3

without patch boot with audit=1
audit disabled: 41.4
audit enabled: 42.9

with patch boot with audit=0
audit disabled: 38.6
audit enabled: 43.8

with patch boot with audit=1
audit disabled: 44.2
audit enabled: 44.6


So, when audit is enabled at boot. There is virtually no performance 
difference between enabled and not. The old way, we had a 4% performance 
improvement when audit was disabled. Looking at the audit=0 case, there is 
about a 3.5% performance hit when audit is enabled with the new patch. The 
old way, audit disabled was always significantly faster ~ %4. With the patch 
its only about 1% faster.

-Steve




More information about the Linux-audit mailing list