linux-kernel - Re: [PATCH v1] trace-cmd: introduce --initital-delay for record command

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <55abd06d-1cac-8deb-d9be-f661f0ba30e1@redhat.com>
Date:   Mon, 18 Dec 2017 21:56:33 +0100
From:   David Hildenbrand <david@...hat.com>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Trace Devel <linux-trace-devel@...r.kernel.org>
Subject: Re: [PATCH v1] trace-cmd: introduce --initital-delay for record
 command

On 18.12.2017 18:52, Steven Rostedt wrote:
> On Mon, 18 Dec 2017 17:23:24 +0100
> David Hildenbrand <david@...hat.com> wrote:
> 
>> What I need: Start tracing and flush all buffers when exiting. (e.g.
> 
> Why don't you use "trace-cmd start" and "trace-cmd extract"?
> 
> "trace-cmd record" is all about not losing events. If you are creating
> a big buffer, then I think you want to use this.
> 
> # trace-cmd start -p <tracer> -e <events> -b <big-buffer-size>
> # run test
> # trace-cmd stop
> # trace-cmd extract
> 
> Wouldn't that work for you?

It works for some scenarios I have in mind. Especially when recording
long runs, it might be beneficial to e.g. wakeup every 30 seconds to
just write out a couple of MB of traces (compared to right now -s
30000000 waking up every couple of milliseconds).

With start/stop/extract the downside is, that buffers have to be huge
for longer runs.

I'll have a try tomorrow if I I''lose events with 20MB buffers per CPU
when recording more than 60 seconds (on a very active system with
mentioned scheduler rtaces being turned on).

Thanks!

> 
> -- Steve
> 
>> after 30 seconds). Never wakeup in between, so the real trace overhead
>> in that period of time is purely storing the tracepoints to the buffer
>> in the kernel. Of course we could implement something like that ("copy
>> from the buffer only when exiting") or try to see if we can fix the
>> existing "-s" flag in a way that allows it.


-- 

Thanks,

David / dhildenb