performance questions

I was looking at some strace results from a process using the audit_log_user_message call and I think I see how I can eliminate some ioctls and /proc/self lookups by setting the hostname/tty parameters to non-NULL pointers pointing to NULL values. But the exename is another story. It does a lookup each time. We have persistent processes each of which submit 100Ks (on the way to 1Ms) of audit_log_user_message events daily, so it would make a difference. I was thinking about a patch to store off the exename statically if one isn't already in the pipeline. Let me know; I'll submit something if not. The other question is on the auditd side. IIUC on each event the write_to_log function is checking the logfile size. Seems to me that we could limit the fstat checks to say one every ten events or so. Any problems there? Thx, LCB -- LC (Lenny) Bruzenak lenny(a)magitekltd.com