Re: Watch Performance

[Alexander Viro <aviro@redhat.com>]

On Wed, May 10, 2006 at 11:32:40AM -0400, Steve Grubb wrote:
> On Tuesday 11 April 2006 17:01, Steve Grubb wrote:
> > OK, I re-worked auditctl to use these syscalls instead of "all". I then
> > re-ran the tests on the same kernel as I was testing on since lspp.17 has
> > slab debug stuff turned on again.
> >
> > rules ?seconds ? ?loss
> > 0 ? ? ? ?50 ? ? ? ? ? ?0%
> > 10 ? ? ?52 ? ? ? ? ? ?4%
> > 25 ? ? ?56 ? ? ? ? ? ?12%
> > 50 ? ? ?69 ? ? ? ? ? ?38%
> > 75 ? ? ?81 ? ? ? ? ? ?62%
> > 90 ? ? ?87 ? ? ? ? ? ?74%
> 
> I re-ran the analysis with the lspp.24 kernel. This is the results:
> 
> rules  seconds    loss
> 0        57.4           0.0%
> 10      57.8           0.7%
> 25      56.7         +1.2%
> 50      58.6           2.1%
> 75      59.7           4.0%
> 90      59.1           3.0%
> 
> 
> The results look good for this test case. Thanks to everyone that helped solve 
> this problem! Good job.

Hrm...  Results do look good, but I wonder what had given us >10% loss
in the baseline.  Would be nice if somebody rerun the tests with 0 rules
on lspp.24 and whatever had been used to generate original numbers and
did it with profiling enabled.  If this difference is real, it should show
up in profiles in enough details...