Re: Trace syscalls

[Tim Bird <tim dot bird at am dot sony dot com>]

Frank Ch. Eigler wrote:
> It is tempting to use an overbroad wildcard for that @2 parameter, but
> just try with specific files (or function name patterns, or
> directories) first.  Our kernel probing blacklist is not sufficiently
> broad yet, and a plain '*' can still bring down a machine.

FWIW, maintaining the blacklist for Kernel Function Trace (which puts
a hook in every kernel function prologue and epilogue) is one of the
painful aspects of that project.

My experience with KFT overhead is that it about doubles the execution
time of the kernel while it is active.  This is  considerable, but getting
a call trace can be worth it.  This is especially true when it traces
through many layers of function pointers, which are very, very annoying to
try to follow in source.

I was waiting for the new system tracing work by Steven Rostedt to make
it into the kernel before trying to push some KFT bits upstream. Optimally
this kind of thing could be done with Markers and somehow integrated for
SystemTap to utilize by flipping a switch (sometime in the distant future).

Anyway - just some random comments...
 -- Tim

=============================
Tim Bird
Architecture Group Chair, CE Linux Forum
Senior Staff Engineer, Sony Corporation of America
=============================