On Thursday 08 September 2005 13:21, Chris Wright wrote:
* Steve Grubb (sgrubb(a)redhat.com) wrote:
> On Thursday 08 September 2005 13:28, Chris Wright wrote:
> > Any micro optimisation needs to be benchmarked to show whether it's really
> > useful (I'd expect this one to be in the noise even though assembly
> > inspection should show improvement).
>
> I think we have to start thinking about this. People are comparing system
> performance with audit disabled and enabled and not compiled in at all. The
> hit is significant. We need to see what can be done to make it better.
Absolutely agreed. Profiles would be quite helpful here.
> > IMO, a better choice would be a static inline stub to keep from cluttering
> > call sites. Smth. like:
>
> I like this. Easy to contain the changes without a big change to any patch.
> But just to be sure, I'm not talking only about the one case I posted.
> syscall_entry & exit are a bigger hit as it affects all syscalls.
Yup, generic change that potentially improves every call site.
This stradegy will fall in line with using fsnotify hooks.
thanks,
-chris
--
Linux-audit mailing list
Linux-audit(a)redhat.com
http://www.redhat.com/mailman/listinfo/linux-audit