"Time police" - best way to submit?

[joshc@eso.teric.us (Josh Cartwright)]

On Wed, Apr 16, 2014 at 02:27:50PM -0700, Henry Hallam wrote:
> Hi, my name is Henry and I'm a kernel newbie.

Hello, Henry.

> Recently plagued by a perplexing issue where *something* would step
> the clock on an important server by exactly 5 minutes at infrequent,
> unpredictable intervals, I put together my first kernel module - a
> trivial hook into do_settimeofday via a jprobe, that prints the PID,
> process name and time adjustment to the kernel message log.
> 
> Here's what I have so far:
> https://github.com/henryhallam/timepolice
> 
> Questions:
> 
> 1. Is a module using kprobes/jprobes the right way to do it, vs adding
> printks to linux/time/timekeeping.c?

Have you taken a look at the various kernel tracing features?  I suspect
you could do exactly what you want without modifying the kernel at all
using the function tracer.

  Josh