Messages in this thread | | | Date | Fri, 24 Mar 2006 22:24:42 +0800 | From | yang.y.yi@gmail ... | Subject | Re: Connector: Filesystem Events Connector v3 |
| |
On 3/24/06, Arjan van de Ven <arjan@infradead.org> wrote: > > > It is also never redundant functionality of audit subsystem, if enable > > audit option, audit subsystem will audit all the syscalls, so it adds > > big overhead for the whole system, > > this is not true Hmm, Why? > > > but Filesystem Event Connector just > > concerns those operations related to the filesystem, so it has little > > overhead, moreover, audit subsystem is a complicated function block, > > it not only sends audit results to netlink interface, but also send > > them to klog or syslog, so it will add big overhead. you can look File > > Event Connector as subset of audit subsystem, but File Event Connector > > is a very very lightweight subsystem. > > then make the syslog part optional.. if it's not already! > > > - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |