* [FS] New monitor framework in 2.6.10?
@ 2004-11-15 10:13 Stephan Menzel
2004-11-15 10:23 ` Jan Engelhardt
0 siblings, 1 reply; 5+ messages in thread
From: Stephan Menzel @ 2004-11-15 10:13 UTC (permalink / raw)
To: linux-kernel
Hi,
i'm maintaining a kernel patch which is monitoring file system activity
underneath a special directory tree and reporting occuring events via a
character device to userland where it is processed.
Right now, this patch works via a number of hooks in fs/read-write.c and
fs/namei.c.
This is not really efficient at the moment because this way I get an event for
any written block and not per file which can slow things down a lot.
A couple of days ago I heard rumours about a new feature in 2.6.10 which will
be exactly for this kind of purpose. Some kind of monitor frameworks that can
generate events for all sorts of things. Sorry, I don't know any more about
it.
Is that true?
Would that be suitable for my task?
And where can I get information about it?
Greetings...
Stephan
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [FS] New monitor framework in 2.6.10?
2004-11-15 10:13 [FS] New monitor framework in 2.6.10? Stephan Menzel
@ 2004-11-15 10:23 ` Jan Engelhardt
2004-11-15 10:42 ` Stephan Menzel
0 siblings, 1 reply; 5+ messages in thread
From: Jan Engelhardt @ 2004-11-15 10:23 UTC (permalink / raw)
To: Stephan Menzel; +Cc: linux-kernel
>Hi,
>
>i'm maintaining a kernel patch which is monitoring file system activity
>underneath a special directory tree and reporting occuring events via a
>character device to userland where it is processed.
>Right now, this patch works via a number of hooks in fs/read-write.c and
>fs/namei.c.
>This is not really efficient at the moment because this way I get an event for
>any written block and not per file which can slow things down a lot.
>A couple of days ago I heard rumours about a new feature in 2.6.10 which will
>be exactly for this kind of purpose. Some kind of monitor frameworks that can
>generate events for all sorts of things. Sorry, I don't know any more about
>it.
Wasnot it called System Call Auditing and/or Filesystem hooks?
>Is that true?
>Would that be suitable for my task?
>And where can I get information about it?
One or the other was present in SUSE's 2.4.20/.21 kernels and one is in 2.6.x
-- and from what I have seen, they're just hooks, i.e.
if(hook != NULL) { hook(fd, buf, size); }
That's the most efficient thing you can have (in a function). It's only a
question whether it is in the right function, then.
Jan Engelhardt
--
Gesellschaft für Wissenschaftliche Datenverarbeitung
Am Fassberg, 37077 Göttingen, www.gwdg.de
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [FS] New monitor framework in 2.6.10?
2004-11-15 10:23 ` Jan Engelhardt
@ 2004-11-15 10:42 ` Stephan Menzel
2004-11-15 12:44 ` Stephan Menzel
0 siblings, 1 reply; 5+ messages in thread
From: Stephan Menzel @ 2004-11-15 10:42 UTC (permalink / raw)
To: linux-kernel
Am Montag, 15. November 2004 11:23 schrieb Jan Engelhardt:
> > will be exactly for this kind of purpose. Some kind of monitor frameworks
> > that can generate events for all sorts of things. Sorry, I don't know any
> > more about it.
>
> Wasnot it called System Call Auditing and/or Filesystem hooks?
Well, that's what I'd like to know.
System Call Auditing just yielded a few google results but it doesn't seem to
me like a well documented feature. More like people asking for it.
> One or the other was present in SUSE's 2.4.20/.21 kernels and one is in
> 2.6.x -- and from what I have seen, they're just hooks, i.e.
>
> if(hook != NULL) { hook(fd, buf, size); }
>
> That's the most efficient thing you can have (in a function). It's only a
> question whether it is in the right function, then.
Indeed.
And just that made me hope there is something like an auditing or monitoring
framework just like for instance a accessible struct with several function
pointers where one could insert funtions to be processed whenever event x
occurs. This kind of thing yould be maintained by the kernel developers who
could put the hook just in the right place and the 'user' (which would be me
in that case) could be sure that his function would be called in the right
time and from the right place.
That would be nice.
Greetings...
Stephan
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2004-11-15 13:29 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2004-11-15 10:13 [FS] New monitor framework in 2.6.10? Stephan Menzel
2004-11-15 10:23 ` Jan Engelhardt
2004-11-15 10:42 ` Stephan Menzel
2004-11-15 12:44 ` Stephan Menzel
2004-11-15 13:29 ` Paolo Ciarrocchi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome