Tracing each new process...

Tracing each new process...

[Fabrizio Morbini]

Hi, somebody know how signaling the creation of each new process?
(watching the proc filesystem or ps output is too slow)

If this software doesn't exists where (in the kernel source) I must
insert hook for tracing the creation of new process?

Thank you very much for any help!!

Fabrizio.

Re: Tracing each new process...

[Karim Yaghmour]

Have a look at the Linux Trace Toolkit:
http://www.opersys.com/LTT/

Fabrizio Morbini wrote:
> Hi, somebody know how signaling the creation of each new process?
> (watching the proc filesystem or ps output is too slow)
> 
> If this software doesn't exists where (in the kernel source) I must
> insert hook for tracing the creation of new process?
> 
> Thank you very much for any help!!
> 
> Fabrizio.
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

-- 
===================================================
                 Karim Yaghmour
               karim@opersys.com
      Embedded and Real-Time Linux Expert
===================================================

Re: Tracing each new process...

[Muli Ben-Yehuda]

[-- Attachment #1: Type: text/plain, Size: 687 bytes --]

On Thu, Aug 01, 2002 at 01:04:51PM -0400, Karim Yaghmour wrote:
> 
> Have a look at the Linux Trace Toolkit:
> http://www.opersys.com/LTT/

syscalltrack, http://syscalltrack.sourceforge.net can do it as
well. You'll get the notification in user space out of the box, and in
kernel space with a bit of hacking. 

> Fabrizio Morbini wrote:
> > Hi, somebody know how signaling the creation of each new process?
> > (watching the proc filesystem or ps output is too slow)
> > 
> > If this software doesn't exists where (in the kernel source) I must
> > insert hook for tracing the creation of new process?
-- 
http://vipe.technion.ac.il/~mulix/
http://syscalltrack.sf.net/

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: Tracing each new process...

[Karim Yaghmour]

Muli Ben-Yehuda wrote:
> On Thu, Aug 01, 2002 at 01:04:51PM -0400, Karim Yaghmour wrote:
> >
> > Have a look at the Linux Trace Toolkit:
> > http://www.opersys.com/LTT/
> 
> syscalltrack, http://syscalltrack.sourceforge.net can do it as
> well. You'll get the notification in user space out of the box, and in
> kernel space with a bit of hacking.

Syscalltrack is only for tracking system calls. If the process creation
was requested from user-space, then indeed syscalltrack will show it.
It won't see kernel threads, among many other things. Not to mention
that it has to play around with the system call table to get its
information.

Now that you mention it, however, it is clear to me that syscalltrack
could definitely use the tracing framework provided by LTT in many
areas. First and foremost, it could get its system call information
using the existing trace hooks provided by LTT. In addition, instead
of implementing yet another event buffering framework, it could
use LTT's trace driver which already provides very efficient buffering.

Yet another reason to include LTT in the kernel.

Karim

===================================================
                 Karim Yaghmour
               karim@opersys.com
      Embedded and Real-Time Linux Expert
===================================================