From mboxrd@z Thu Jan 1 00:00:00 1970 From: Amy Griffis Subject: Re: Watch Performance Date: Tue, 11 Apr 2006 12:11:41 -0400 Message-ID: <20060411161141.GA16506@zk3.dec.com> References: <200604081221.58080.sgrubb@redhat.com> <20060411035138.GD656@sage.flatmonk> <200604110626.26843.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <200604110626.26843.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: redhat-lspp@redhat.com List-Id: linux-audit@redhat.com On Tue, Apr 11, 2006 at 06:26:26AM -0400, Steve Grubb wrote: > On Monday 10 April 2006 23:51, Amy Griffis wrote: > > 1) what audit rules did you use? > > I used the lspp rules to get the 1st 10, and the rest were against files > in /etc/test. I took a look at the rules lists in the tarball you sent. The rules are not specified in a way that makes sense with what you are measuring. The watches are added with the -w syntax. In auditctl, this translates to setting an "all" syscall rule. > -w /etc/sysconfig/console > -w /etc/sysconfig/pm > -w /etc/sysconfig/system-config-users > -w /etc/sysconfig/init > -w /etc/sysconfig/hwconf > -w /etc/sysconfig/netdump > -w /etc/sysconfig/selinux > -w /etc/sysconfig/hsqldb > -w /etc/sysconfig/system-config-securitylevel > -w /etc/sysconfig/mouse > -w /etc/sysconfig/saslauthd.rpmnew > -w /etc/sysconfig/netdump_id_dsa.pub > -w /etc/sysconfig/clock > -w /etc/sysconfig/grub > -w /etc/sysconfig/wpa_supplicant > ... So for your worst-case, you have added 80 syscall rules that apply to the access system call. It is not surprising that this would significantly affect the performance of access(). IIRC, these rules were supposed to apply to watches. > -a entry,possible -S chmod -S fchmod -S chown -S fchown -S lchown > -a entry,possible -S creat -S open -S truncate -S ftruncate > -a entry,possible -S mkdir -S rmdir > -a entry,possible -S unlink -S rename -S link -S symlink In the present implementation, the equivalent to the above groups is (per each watch): -a exit,always -S chmod -S fchmod -S chown -S fchown -S lchown -S creat -S open -S truncate -S ftruncate -S mkdir -S rmdir -S unlink -S rename -S link -S symlink -F watch=/etc/sysconfig/console Now you don't have any rules for access(), so using it as the test case is much more interesting. > -a entry,always -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr > -a entry,always -S mknod > -a entry,always -S mount > -a entry,always -S adjtimex -S settimeofday Ideally, these would be a single rule. > > 2) what system call(s) did you measure? > > access("/usr/include", 0); > > The watch rules were never triggered because I wanted to measure the overhead > where no audit events occur. The syscall exercises the file system without > doing any IO, which would complicate things, too. > > -Steve >