Re: Watch Performance

[Amy Griffis <amy.griffis@hp.com>]

On Tue, Apr 11, 2006 at 06:26:26AM -0400, Steve Grubb wrote:
> On Monday 10 April 2006 23:51, Amy Griffis wrote:
> > 1) what audit rules did you use?
> 
> I used the lspp rules to get the 1st 10, and the rest were against files 
> in /etc/test.

I took a look at the rules lists in the tarball you sent.  The rules
are not specified in a way that makes sense with what you are
measuring.

The watches are added with the -w syntax.  In auditctl, this
translates to setting an "all" syscall rule.

> -w /etc/sysconfig/console
> -w /etc/sysconfig/pm
> -w /etc/sysconfig/system-config-users
> -w /etc/sysconfig/init
> -w /etc/sysconfig/hwconf
> -w /etc/sysconfig/netdump
> -w /etc/sysconfig/selinux
> -w /etc/sysconfig/hsqldb
> -w /etc/sysconfig/system-config-securitylevel
> -w /etc/sysconfig/mouse
> -w /etc/sysconfig/saslauthd.rpmnew
> -w /etc/sysconfig/netdump_id_dsa.pub
> -w /etc/sysconfig/clock
> -w /etc/sysconfig/grub
> -w /etc/sysconfig/wpa_supplicant
> ...

So for your worst-case, you have added 80 syscall rules that apply to
the access system call.  It is not surprising that this would
significantly affect the performance of access().

IIRC, these rules were supposed to apply to watches.

> -a entry,possible -S chmod -S fchmod -S chown -S fchown -S lchown
> -a entry,possible -S creat -S open -S truncate -S ftruncate
> -a entry,possible -S mkdir -S rmdir
> -a entry,possible -S unlink -S rename -S link -S symlink

In the present implementation, the equivalent to the above groups is
(per each watch):

-a exit,always -S chmod -S fchmod -S chown -S fchown -S lchown 
-S creat -S open -S truncate -S ftruncate -S mkdir -S rmdir -S unlink 
-S rename -S link -S symlink -F watch=/etc/sysconfig/console

Now you don't have any rules for access(), so using it as the test
case is much more interesting.

> -a entry,always -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr
> -a entry,always -S mknod
> -a entry,always -S mount
> -a entry,always -S adjtimex -S settimeofday

Ideally, these would be a single rule.

> > 2) what system call(s) did you measure?
> 
> access("/usr/include", 0);
> 
> The watch rules were never triggered because I wanted to measure the overhead 
> where no audit events occur. The syscall exercises the file system without 
> doing any IO, which would complicate things, too.
> 
> -Steve
>