On Thursday 08 September 2005 13:21, Chris Wright wrote:
 * Steve Grubb (sgrubb(a)redhat.com) wrote:
 > On Thursday 08 September 2005 13:28, Chris Wright wrote:
 > > Any micro optimisation needs to be benchmarked to show whether it's really
 > > useful (I'd expect this one to be in the noise even though assembly
 > > inspection should show improvement).
 > 
 > I think we have to start thinking about this. People are comparing system 
 > performance with audit disabled and enabled and not compiled in at all. The 
 > hit is significant. We need to see what can be done to make it better.
 
 Absolutely agreed.  Profiles would be quite helpful here.
 
 > > IMO, a better choice would be a static inline stub to keep from cluttering
 > > call sites.  Smth. like: 
 > 
 > I like this. Easy to contain the changes without a big change to any patch. 
 > But just to be sure, I'm not talking only about the one case I posted. 
 > syscall_entry & exit are a bigger hit as it affects all syscalls.
 
 Yup, generic change that potentially improves every call site. 
This stradegy will fall in line with using fsnotify hooks.
 
 thanks,
 -chris
 
 --
 Linux-audit mailing list
 Linux-audit(a)redhat.com
 
http://www.redhat.com/mailman/listinfo/linux-audit