From mboxrd@z Thu Jan 1 00:00:00 1970 From: joshc@eso.teric.us (Josh Cartwright) Date: Fri, 18 Apr 2014 15:51:30 -0500 Subject: "Time police" - best way to submit? In-Reply-To: References: Message-ID: <20140418205129.GO526@kryptos> To: kernelnewbies@lists.kernelnewbies.org List-Id: kernelnewbies.lists.kernelnewbies.org On Wed, Apr 16, 2014 at 02:27:50PM -0700, Henry Hallam wrote: > Hi, my name is Henry and I'm a kernel newbie. Hello, Henry. > Recently plagued by a perplexing issue where *something* would step > the clock on an important server by exactly 5 minutes at infrequent, > unpredictable intervals, I put together my first kernel module - a > trivial hook into do_settimeofday via a jprobe, that prints the PID, > process name and time adjustment to the kernel message log. > > Here's what I have so far: > https://github.com/henryhallam/timepolice > > Questions: > > 1. Is a module using kprobes/jprobes the right way to do it, vs adding > printks to linux/time/timekeeping.c? Have you taken a look at the various kernel tracing features? I suspect you could do exactly what you want without modifying the kernel at all using the function tracer. Josh