From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <61909b30c2fd4aed1dc3174595a1e4a7@coraid.com>
From: erik quanstrom <quanstro@coraid.com>
Date: Tue, 17 Apr 2007 11:45:29 -0400
To: 9fans@cse.psu.edu
Subject: Re: [9fans] syscall spikes
In-Reply-To: <9ab217670704170838g363bba09pc0328e13106d0efd@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Topicbox-Message-UUID: 4b4f8ac8-ead2-11e9-9d60-3106f5b1d025

are you running anything that faces the outside world that
might be doing auth?  if you don't have a /sys/log/auth, you
might want to create it and watch it for any external attacks.

i've found that to be a source of big syscall loads on some of
our systems.

- erik

On Tue Apr 17 11:38:33 EDT 2007, devon.odell@gmail.com wrote:
> 2007/4/17, Devon H. O'Dell <devon.odell@gmail.com>:
> > 2007/4/17, Uriel <uriel99@gmail.com>:
> > > fossil
> >
> > I attempted to tprof fossil and I don't get any useful output. I even did:
> >
> > for (i in `{ps a | grep fossil | awk '{ print $2 }'})
> >     echo profile > /proc/$i/ctl
> >
> > [wait a while for spike]
> >
> > for (i in `{ps a | grep fossil | awk '{ print $2 }'}) {
> >     echo $i
> >     tprof $i
> > }
> >
> > All I get is a bunch of lines saying ``total: 0''.
> >
> > What'm I missing? :(
> 
> I found the [undocumented] startsyscall argument to the process ctl
> file, but I cannot get it to work. If I echo startsyscall >
> /proc/N/ctl, I get ``echo: write error: bad process or channel control
> request''.
> 
> What gives?
> 
> --dho
> 
> > --dho
> >
> > > On 4/17/07, Devon H. O'Dell <devon.odell@gmail.com> wrote:
> > > > Hi,
> > > >
> > > > I've been having syscall spikes. It's really weird. There will be
> > > > >40,000 in 1 second, (according to stats(8)) and it appears at a