linux-kernel - Re: Help with trace-cmd/ftrace recording process ID information

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170717161712.6bc38c83@gandalf.local.home>
Date:   Mon, 17 Jul 2017 16:17:12 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Will Hawkins <hawkinsw@...laugic.com>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: Help with trace-cmd/ftrace recording process ID information

On Mon, 17 Jul 2017 16:06:37 -0400
Will Hawkins <hawkinsw@...laugic.com> wrote:


> This seems to be the problem:
> 
> On the "good" system, that file is up-to-date with cached PIDs and
> comms. On the bad host, there are no cached entries from any of the
> traces that I've run.
> 
> Because these are running old kernels, there is no saved_cmdlines_size
> knob to turn. Do you have any idea why the saved_cmdlines would not be
> getting updated appropriately on the "bad" host? I know this is not
> ideal, but I can try to reboot that host and see if something is

Yeah, a reboot may work.

> simply wedged. The system has been online for almost a year, so it's
> possible that something has gone wrong.
> 
> Any help you can offer would be great! Thank you, again, for your response!

The recording of command lines only happens when tracing is done, and
there were a few bugs with the older kernels that caused it to either
stop and never start again, or to simply just miss a bunch of recording.

It may be that it stopped and never started again, so you will only
have a stale file.

-- Steve