Messages in this thread | | | Date | Mon, 15 Nov 2004 11:23:35 +0100 (MET) | From | Jan Engelhardt <> | Subject | Re: [FS] New monitor framework in 2.6.10? |
| |
>Hi, > >i'm maintaining a kernel patch which is monitoring file system activity >underneath a special directory tree and reporting occuring events via a >character device to userland where it is processed. >Right now, this patch works via a number of hooks in fs/read-write.c and >fs/namei.c. >This is not really efficient at the moment because this way I get an event for >any written block and not per file which can slow things down a lot. >A couple of days ago I heard rumours about a new feature in 2.6.10 which will >be exactly for this kind of purpose. Some kind of monitor frameworks that can >generate events for all sorts of things. Sorry, I don't know any more about >it.
Wasnot it called System Call Auditing and/or Filesystem hooks?
>Is that true? >Would that be suitable for my task? >And where can I get information about it?
One or the other was present in SUSE's 2.4.20/.21 kernels and one is in 2.6.x -- and from what I have seen, they're just hooks, i.e.
if(hook != NULL) { hook(fd, buf, size); }
That's the most efficient thing you can have (in a function). It's only a question whether it is in the right function, then.
Jan Engelhardt -- Gesellschaft für Wissenschaftliche Datenverarbeitung Am Fassberg, 37077 Göttingen, www.gwdg.de - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |