Em Fri, Oct 05, 2018 at 11:44:35AM -0700, Alexei Starovoitov escreveu: > On Fri, Oct 05, 2018 at 08:14:09AM +0200, Jiri Olsa wrote: > > On Thu, Oct 04, 2018 at 03:10:15PM -0700, Alexei Starovoitov wrote: > > > On Thu, Oct 04, 2018 at 10:22:31PM +0200, Jesper Dangaard Brouer wrote: > > > > My use-case is to 24/7 collect and keep records in userspace, and have a > > > > timeline of these notifications, for later retrieval. The idea is that > > > > our support engineers can look at these records when troubleshooting > > > > the system. And the plan is also to collect these records as part of > > > > our sosreport tool, which is part of the support case.
> > > I don't think you're implying that prog load/unload should be spamming > > > dmesg > > > and auditd not even running... > > I think the problem Jesper implied is that in order to collect > > those logs you'll need perf tool running all the time.. which > > it's not equipped for yet > I'm not proposing to run 'perf' binary all the time. I think Jiri just said that one would have to run something all the time to get all the records, see below > Setting up perf ring buffer just for these new bpf prog load/unload events > and epolling it is simple enough to do from any application including auditd. > selftests/bpf/ do it for bpf output events. I think he is talking about the preexisting loaded BPF programs. We have the same problem with mmaps, where the perf tool will, with races, enumerate the existing mmaps as PERF_RECORD_MMAP synthesized from /proc/PIDS/smaps. There was talk in the past to ask the kernel to emit PERF_RECORD_MMAP into the ring buffer for those pre-existing entries, reducing a bit the races, but as there doesn't seem to have a good way of doing it, we continued with the synthesizing from procfs. Is there a way for us to synthesize those prog load/unload for preexisting loaded bpf objects? - Arnaldo
