linux-kernel - Re: [RFC PATCH v2] Tracepoint: add exec tracepoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 07 Nov 2011 09:57:30 -0600
From:	David Smith <dsmith@...hat.com>
To:	Peter Zijlstra <a.p.zijlstra@...llo.nl>
CC:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Ingo Molnar <mingo@...e.hu>
Subject: Re: [RFC PATCH v2] Tracepoint: add exec tracepoint

On 11/07/2011 06:56 AM, Peter Zijlstra wrote:

> On Thu, 2011-11-03 at 10:59 -0500, David Smith wrote:
>> Added general purpose exec tracepoint.  The 'bprm' argument gives
>> details of the exec.

>>

> This 'changelog' if one can call it that, is completely devoid of
> rationale, why should we care and why should we merge.

Sorry for being too terse.

Exec is an important major event in the life of a task (like fork or
exit).  If you want to watch a task start up, when it gets exec'ed is a
good place to start.  With the addition of this tracepoint, we can
monitor exec's and get a better picture of system activity in general.
This will also enable better process tracking, allowing you to answer
questions like "what process keeps starting up process X?".

This tracepoint can also be useful in ftrace filtering (i.e. starting or
stopping filtering when exec is called)

-- 
David Smith
dsmith@...hat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/