Re: [Announce] Non Invasive Kernel Monitor for threads/processes

[Rusty Lynch <rusty@linux.jf.intel.com>]

On Wed, Jun 16, 2004 at 10:28:03AM -0400, Chris Friesen wrote:
> Sabharwal, Atul wrote:
> 
> >How does auditing work in the event of a process failure ? There would
> >be
> >no system call triggered in that case.  Also, my initial thoughts are
> >that the non-invasive Kmonitor is lesser performance impact when
> >compared
> >to auditing. I would spend some time developing sample code to confirm
> >it.
> 
> Just to put in my $.02.  We developed a very simple (even simpler than 
> Kmonitor in that it didn't track fork/exec) way for a process to get 
> notified when other processes exited (properly or otherwise).  We want to 
> use this in the field for a lifecycle monitoring function (a sort of 
> super-init) so it needs to be as lightweight as possible.  I'd love to be 
> able to use something from the mainline kernel, but it has to be 
> field-runnable without slowing stuff down.
> 
> Chris

I think your requriement is the core requirement that we were tackling, and
the tracking for fork/exec was more of a feature creap thing.

So far suggestions include...

PAGG: never heard of it, but will look into it
LTT: I think this will cause too much overhead from all the hooks that
     we don't need, but we need to verify this.
Auditing:  Working on some very simple examples to understand how to use
           this correctly, and to understand if this is good enough, or if
           there are some modifications that could be made that would make it
           fit this very limited use of auditing.

    --rusty