linux-kernel - Re: [PATCH 00/10] perf tools: Use SIGUSR2 control data dumpping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160413171543.GH9056@kernel.org>
Date:	Wed, 13 Apr 2016 14:15:43 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	Wang Nan <wangnan0@...wei.com>
Cc:	linux-kernel@...r.kernel.org, pi3orama@....com,
	He Kuang <hekuang@...wei.com>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Jiri Olsa <jolsa@...nel.org>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Zefan Li <lizefan@...wei.com>
Subject: Re: [PATCH 00/10] perf tools: Use SIGUSR2 control data dumpping

Em Wed, Apr 13, 2016 at 08:21:03AM +0000, Wang Nan escreveu:
> This patch set is a preparation to support overwritable ring buffer.
> However, even without the kernel side core patch [1] is accept this
> patch set is still useful.
 
> With this patch set, perf switches output when receiving SIGUSR2. For
> example:
 
>  # perf record -a -F99 --switch-output &
>  [1] 26435
>  # kill -s SIGUSR2 26435
>  [ perf record: dump data: Woken up 1 times ]
>  # [ perf record: Dump perf.data.2016041323544373 ]
>  # kill -s SIGUSR2 26435
>  [ perf record: dump data: Woken up 1 times ]
>  # [ perf record: Dump perf.data.2016041323544730 ]
>  # fg
>  perf record -a -F99 --switch-output
>  ^C[ perf record: Woken up 1 times to write data ]
>  [ perf record: Dump perf.data.2016041323545019 ]
>  [ perf record: Captured and wrote 0.395 MB perf.data.<timestamp> ]
> 
> User can periodically generates perf trace with a simple script, then
> remove most of them, only keeps scripts collected when something
> unusual is detected.

Looks useful, I'll test it, but it ends up adding overhead at the time
of the switch that sometimes may not be interesting. In such cases maybe
it would be interesting to instead of a signal and the perf.data file
switch to just add a marker, i.e. a bpf or perf probe event, even the
equivalent to a trace_printk(), to be used later for doing the slicing.

But yeah, for lower freq events doing like you do, to allow use of 'perf
script', unchanged, to determine what slices (files) should be kept
looks useful.
 
> After [1], perf can be totally silent before receiving SIGUSR2. Trace
> is collected in kernel overwritable ring buffer, and dumpped when
> SIGUSR2 is received.
> 
> [1] http://lkml.kernel.org/r/1459865478-53413-1-git-send-email-wangnan0@huawei.com
> 
> Cc: Wang Nan <wangnan0@...wei.com>
> Cc: He Kuang <hekuang@...wei.com>
> Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
> Cc: Jiri Olsa <jolsa@...nel.org>
> Cc: Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
> Cc: Namhyung Kim <namhyung@...nel.org>
> Cc: Zefan Li <lizefan@...wei.com>
> Cc: pi3orama@....com
> 
> Wang Nan (10):
>   perf tools: Make ordered_events reusable
>   perf tools: Add perf_data_file__switch() helper
>   perf record: Turns auxtrace_snapshot_enable into 3 states
>   perf record: Add '--timestamp-filename' option to append timestamp to
>     output filename
>   perf record: Split output into multiple files via '--switch-output'
>   perf record: Force enable --timestamp-filename when --switch-output is
>     provided
>   perf record: Disable buildid cache options by default in switch output
>     mode
>   perf record: Re-synthesize tracking events after output switching
>   perf record: Generate tracking events for process forked by perf
>   perf core: Add backward attribute to perf event
> 
>  include/linux/perf_event.h       |  28 +++++-
>  include/uapi/linux/perf_event.h  |   3 +-
>  kernel/events/core.c             |  48 ++++++++-
>  kernel/events/ring_buffer.c      |  16 ++-
>  tools/perf/builtin-record.c      | 208 +++++++++++++++++++++++++++++++++++----
>  tools/perf/util/data.c           |  41 ++++++++
>  tools/perf/util/data.h           |  11 ++-
>  tools/perf/util/ordered-events.c |   9 ++
>  tools/perf/util/ordered-events.h |   1 +
>  tools/perf/util/session.c        |   6 +-
>  10 files changed, 341 insertions(+), 30 deletions(-)
> 
> -- 
> 1.8.3.4