From: Paul Moore <paul@paul-moore.com>
To: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Cc: eparis@redhat.com, linux-kernel@vger.kernel.org, audit@vger.kernel.org
Subject: Re: [PATCH v2 1/2] audit: add global auditd_pid to make auditd_test_task() faster
Date: Tue, 18 Apr 2023 09:19:36 -0400 [thread overview]
Message-ID: <CAHC9VhQO8bSdbFYszvjWNT1GCCBr8yusDEq1f52akJApXq8kGA@mail.gmail.com> (raw)
In-Reply-To: <20230418110919.221578-2-eiichi.tsukata@nutanix.com>
On Tue, Apr 18, 2023 at 7:10 AM Eiichi Tsukata
<eiichi.tsukata@nutanix.com> wrote:
>
> auditd_test_task() is a hot path of system call auditing. This patch
> introduces a global auditd_pid pid struct which can be used for faster
> check of registered audit daemon.
>
> Benchmarks
> ==========
>
> Run the following micro benchmarks:
>
> (1) dd:
> dd if=/dev/zero of=/dev/null bs=1 count=5M
>
> (2) UnixBench syscall:
> ./Run syscall -i 10 -c 1
>
> With rule:
>
> -a never,exit -F arch=b64 -S uname
>
> Results:
>
> (1) dd
> Base line : 2.572 sec
> /w this patch: 2.418 sec (6.3% faster)
>
> (2) UnixBench syscall Index Score
> Base line : 860
> /w this patch: 953 (10.8% faster)
>
> Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
> ---
> kernel/audit.c | 39 +++++++++++----------------------------
> kernel/audit.h | 4 +++-
> 2 files changed, 14 insertions(+), 29 deletions(-)
>
> diff --git a/kernel/audit.c b/kernel/audit.c
> index 9bc0b0301198..9426980368e4 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -71,6 +71,7 @@ static int audit_initialized = AUDIT_UNINITIALIZED;
>
> u32 audit_enabled = AUDIT_OFF;
> bool audit_ever_enabled = !!AUDIT_OFF;
> +struct pid *auditd_pid;
As discussed previously, I want to keep the auditd tracking PID in the
auditd_connection struct.
--
paul-moore.com
next prev parent reply other threads:[~2023-04-18 13:19 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-18 11:09 [PATCH v2 0/2] audit: syscall audit optimization (> +6% faster) Eiichi Tsukata
2023-04-18 11:09 ` [PATCH v2 1/2] audit: add global auditd_pid to make auditd_test_task() faster Eiichi Tsukata
2023-04-18 13:19 ` Paul Moore [this message]
2023-04-18 11:09 ` [PATCH v2 2/2] audit: replace auditd_conn.pid with auditd_pid Eiichi Tsukata
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHC9VhQO8bSdbFYszvjWNT1GCCBr8yusDEq1f52akJApXq8kGA@mail.gmail.com \
--to=paul@paul-moore.com \
--cc=audit@vger.kernel.org \
--cc=eiichi.tsukata@nutanix.com \
--cc=eparis@redhat.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).