Re: malloc significally impact audit performance

2017-10-23 Thread Steve Grubb
Hello, On Sun, 22 Oct 2017 19:12:34 +0300 Lev Olshvang wrote: > Hello List, >   > I work on Ubuntu 16.10 kernel 4.8 with audit v2.7.7, and we wrote > plugin who get its input from audispd > This plugin process audit messages, mostly syscalls. >   > In out test we saw that malloc of auditd tooks

malloc significally impact audit performance

2017-10-22 Thread Lev Olshvang
Hello List, I work on Ubuntu 16.10 kernel 4.8 with audit v2.7.7, and we wrote plugin who get its input from audispd This plugin process audit messages, mostly syscalls. In out test we saw that malloc of auditd tooks ~5% among 9% of total CPU time audit consumes.  I wonder, whether libauparse indeed