Re: [9fans] syscall spikes

["Devon H. O'Dell" <devon.odell@gmail.com>]

2007/4/17, erik quanstrom <quanstro@coraid.com>:
> are you running anything that faces the outside world that
> might be doing auth?  if you don't have a /sys/log/auth, you
> might want to create it and watch it for any external attacks.
>
> i've found that to be a source of big syscall loads on some of
> our systems.

Nope, it's just a laptop on a network, and the spikes are very short
(1s bursts), and happen possibly once per minute or so, but they're
fairly evenly spaced, though not always.

Charles: I dug around in the code and it appears that it actually
stops the process and does nothing else. I can't see where any syscall
trace information is actually generated from it. So it doesn't seem
like a big problem that I can't get it to work, since it's not going
to anyway (or what am I missing?).

I'm considering creating a trace buffer of my own and doing some
heuristics with the timer, where if there have been more than 10,000
syscalls since the last tick, it starts logging them all. Because
honestly, I can't find a better way to do it. Does anybody have any
suggestions before I try this?

> - erik

--dho

> On Tue Apr 17 11:38:33 EDT 2007, devon.odell@gmail.com wrote:
> > 2007/4/17, Devon H. O'Dell <devon.odell@gmail.com>:
> > > 2007/4/17, Uriel <uriel99@gmail.com>:
> > > > fossil
> > >
> > > I attempted to tprof fossil and I don't get any useful output. I even did:
> > >
> > > for (i in `{ps a | grep fossil | awk '{ print $2 }'})
> > >     echo profile > /proc/$i/ctl
> > >
> > > [wait a while for spike]
> > >
> > > for (i in `{ps a | grep fossil | awk '{ print $2 }'}) {
> > >     echo $i
> > >     tprof $i
> > > }
> > >
> > > All I get is a bunch of lines saying ``total: 0''.
> > >
> > > What'm I missing? :(
> >
> > I found the [undocumented] startsyscall argument to the process ctl
> > file, but I cannot get it to work. If I echo startsyscall >
> > /proc/N/ctl, I get ``echo: write error: bad process or channel control
> > request''.
> >
> > What gives?
> >
> > --dho
> >
> > > --dho
> > >
> > > > On 4/17/07, Devon H. O'Dell <devon.odell@gmail.com> wrote:
> > > > > Hi,
> > > > >
> > > > > I've been having syscall spikes. It's really weird. There will be
> > > > > >40,000 in 1 second, (according to stats(8)) and it appears at a
>