Message-ID: <40D058F3.5070109@nortelnetworks.com>
Date: Wed, 16 Jun 2004 10:28:03 -0400
From: Chris Friesen <cfriesen@nortelnetworks.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040113
MIME-Version: 1.0
To: "Sabharwal, Atul" <atul.sabharwal@intel.com>
CC: Chris Wright <chrisw@osdl.org>, linux-kernel@vger.kernel.org
Subject: Re: [Announce] Non Invasive Kernel Monitor for threads/processes
References: <66539F0E7F15B44C9C0FC50D0FF024F7B1A324@orsmsx407>
In-Reply-To: <66539F0E7F15B44C9C0FC50D0FF024F7B1A324@orsmsx407>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1053
Lines: 23

Sabharwal, Atul wrote:

> How does auditing work in the event of a process failure ? There would
> be
> no system call triggered in that case.  Also, my initial thoughts are
> that the non-invasive Kmonitor is lesser performance impact when
> compared
> to auditing. I would spend some time developing sample code to confirm
> it.

Just to put in my $.02.  We developed a very simple (even simpler than Kmonitor 
in that it didn't track fork/exec) way for a process to get notified when other 
processes exited (properly or otherwise).  We want to use this in the field for 
a lifecycle monitoring function (a sort of super-init) so it needs to be as 
lightweight as possible.  I'd love to be able to use something from the mainline 
kernel, but it has to be field-runnable without slowing stuff down.

Chris
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/