From: Vasily Novikov <vasily.novikov@kaspersky.com>
To: Eric Paris <eparis@redhat.com>
Cc: Douglas Leeder <douglas.leeder@sophos.com>,
"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
"malware-list@dmesg.printk.net" <malware-list@dmesg.printk.net>
Subject: Re: [malware-list] A few concerns about fanotify implementation.
Date: Tue, 7 Jun 2011 16:35:10 +0400 [thread overview]
Message-ID: <4DEE1AFE.6030107@kaspersky.com> (raw)
In-Reply-To: <1307375593.2052.7.camel@localhost.localdomain>
Eric,
>> So if we use marks with only 'ignored' events then under memory pressure
>> mm subsystem will shrink inode cache that will free our marks and
>> therefore it's safe to use FAN_UNLIMITED_MARKS in this case?
>> If it really works then we don't need LRU cache in fanotify because it's
>> already implemented in dentry_cache/inode_cache.
>
> That's how it's supposed to work. Just remember, if you set a real
> event, the inode becomes pinned in core and the mm will be unable to
> evict either the inode or the mark.
It really works) On machine with 2GB ram it holds no more than about
3500000 'ignored' marks in 10 groups. After that it begins to evict LRU
files. So it completely satisfies our needs.
What you think about clearing ignored mask not only on FS_MODIFY but
also on FS_ATTRIB and FS_MOVE_SELF?
--
Best regards,
Vasily Novikov | Software developer | Kaspersky Lab
Direct: +7 495 123 45 67 x2344 | Mobile: +7 964 786 44 82 |
vasily.novikov@kaspersky.com
10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia |
www.kaspersky.com, www.securelist.com
next prev parent reply other threads:[~2011-06-07 12:32 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-10-26 12:13 A few concerns about fanotify implementation Vasily Novikov
2010-10-26 12:58 ` [malware-list] " Tvrtko Ursulin
2010-10-26 13:58 ` Vasily Novikov
2010-10-26 14:22 ` Tvrtko Ursulin
[not found] ` <201010261522.34157.tvrtko.ursulin-j34lQMj1tz/QT0dZR+AlfA@public.gmane.org>
2010-10-26 14:58 ` Eric Paris
2010-10-27 8:54 ` [malware-list] " Vasily Novikov
2010-10-27 15:58 ` Eric Paris
[not found] ` <1288195134.2655.202.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org>
2011-06-03 9:43 ` Vasily Novikov
[not found] ` <4DE8ACAD.2080003-BkmlMuIjteXqlBn2x/YWAg@public.gmane.org>
2011-06-06 9:02 ` Douglas Leeder
2011-06-06 9:19 ` [malware-list] " Vasily Novikov
[not found] ` <4DEC9B86.6060506-BkmlMuIjteXqlBn2x/YWAg@public.gmane.org>
2011-06-06 13:43 ` Eric Paris
2011-06-06 14:42 ` [malware-list] " Vasily Novikov
[not found] ` <4DECE76E.4060507-BkmlMuIjteXqlBn2x/YWAg@public.gmane.org>
2011-06-06 15:53 ` Eric Paris
2011-06-07 12:35 ` Vasily Novikov [this message]
[not found] ` <C511438CDC161C41B3C47B91D99ABA8D37B4B42114-u5UUZ0l8pcxUerCGrXd8jcc3qqyFMPEu@public.gmane.org>
2011-06-06 9:42 ` Vasily Novikov
2011-06-06 10:27 ` [malware-list] " Lino Sanfilippo
2011-06-06 11:17 ` [malware-list] A few concerns about fanotify implementation ([PATCH] inside) Lino Sanfilippo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DEE1AFE.6030107@kaspersky.com \
--to=vasily.novikov@kaspersky.com \
--cc=douglas.leeder@sophos.com \
--cc=eparis@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=malware-list@dmesg.printk.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).