From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: audit 1.2.2 released
Date: Tue, 23 May 2006 11:11:59 -0400
Message-ID: <200605231111.59745.sgrubb@redhat.com>
References: <200605121726.32952.sgrubb@redhat.com>
	<20060523065608.GA13276@zk3.dec.com>
	<4ae3c140605222043q717458b1o8a5534aabf29ad25@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <4ae3c140605222043q717458b1o8a5534aabf29ad25@mail.gmail.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Monday 22 May 2006 23:43, Xin Zhao wrote:
> Now I have to move to next question: can auditd record how much time
> each system call uses.

No. Its view of the world is very much like strace's. I think for that you are 
better off looking at system-tap or oprofile:

http://sources.redhat.com/systemtap/documentation.html

> I am developing a file system and might want to monitor all file system
> related system call to find the performance bottleneck in my system.

I have a feeling that system tap may be a better fit for your project. You can 
certainly monitor all files or extend the audit system to give you time hacks 
via an auxiliary record, but that was never its intended use.

Also look at oprofile:
http://oprofile.sourceforge.net/about/

-Steve