Messages in this thread | | | Subject | RE: [Announce] Non Invasive Kernel Monitor for threads/processes | Date | Tue, 15 Jun 2004 17:54:40 -0700 | From | "Sabharwal, Atul" <> |
| |
>* Atul Sabharwal (atul_sabharwal@linux.jf.intel.com) wrote: >> We have been working with a solution for non-intrusively >trapping on lifetime >> of processes/threads. This is useful for management >applications running in >> telecom and enterprise data centers that need to monitor a >set of threads/ >> processes. >> >> Project Goal:: >> ~~~~~~~~~~~~~~ >> To create a kernel patch that shall support methods to >non-intrusively monitor >> processes/threads at the kernel level. It would use a >notfication mechanism in >> the kernel that allows registration of events of interest >regarding processes/ >> threads. Events of interest could be the following : >Process creation (fork), >> Process exit(exit), Process calls(exec), thread creation & >thread exit. > >These spots are already hooked via LSM and audit (the latter is capable >of communicating such events to userspace via netfilter) Was that not >sufficient somehow? In fact, the netfilter queuing will probably fair >better than sigqueue which fairly limited. Might be worth looking into >that. Did you look at the task ornament patch floating about >from David >Howells? If new code is needed, that patch looks more >generically useful. >
How does auditing work in the event of a process failure ? There would be no system call triggered in that case. Also, my initial thoughts are that the non-invasive Kmonitor is lesser performance impact when compared to auditing. I would spend some time developing sample code to confirm it.
I have not looked at the task ornament patch. If you could send me a link. Thanks,
Atul - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |