From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: <9ab217670704170856y7bf2265dl8cf121926232f905@mail.gmail.com> Date: Tue, 17 Apr 2007 11:56:15 -0400 From: "Devon H. O'Dell" To: "Fans of the OS Plan 9 from Bell Labs" <9fans@cse.psu.edu> Subject: Re: [9fans] syscall spikes In-Reply-To: <61909b30c2fd4aed1dc3174595a1e4a7@coraid.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <9ab217670704170838g363bba09pc0328e13106d0efd@mail.gmail.com> <61909b30c2fd4aed1dc3174595a1e4a7@coraid.com> Topicbox-Message-UUID: 4b61849e-ead2-11e9-9d60-3106f5b1d025 2007/4/17, erik quanstrom : > are you running anything that faces the outside world that > might be doing auth? if you don't have a /sys/log/auth, you > might want to create it and watch it for any external attacks. > > i've found that to be a source of big syscall loads on some of > our systems. Nope, it's just a laptop on a network, and the spikes are very short (1s bursts), and happen possibly once per minute or so, but they're fairly evenly spaced, though not always. Charles: I dug around in the code and it appears that it actually stops the process and does nothing else. I can't see where any syscall trace information is actually generated from it. So it doesn't seem like a big problem that I can't get it to work, since it's not going to anyway (or what am I missing?). I'm considering creating a trace buffer of my own and doing some heuristics with the timer, where if there have been more than 10,000 syscalls since the last tick, it starts logging them all. Because honestly, I can't find a better way to do it. Does anybody have any suggestions before I try this? > - erik --dho > On Tue Apr 17 11:38:33 EDT 2007, devon.odell@gmail.com wrote: > > 2007/4/17, Devon H. O'Dell : > > > 2007/4/17, Uriel : > > > > fossil > > > > > > I attempted to tprof fossil and I don't get any useful output. I even did: > > > > > > for (i in `{ps a | grep fossil | awk '{ print $2 }'}) > > > echo profile > /proc/$i/ctl > > > > > > [wait a while for spike] > > > > > > for (i in `{ps a | grep fossil | awk '{ print $2 }'}) { > > > echo $i > > > tprof $i > > > } > > > > > > All I get is a bunch of lines saying ``total: 0''. > > > > > > What'm I missing? :( > > > > I found the [undocumented] startsyscall argument to the process ctl > > file, but I cannot get it to work. If I echo startsyscall > > > /proc/N/ctl, I get ``echo: write error: bad process or channel control > > request''. > > > > What gives? > > > > --dho > > > > > --dho > > > > > > > On 4/17/07, Devon H. O'Dell wrote: > > > > > Hi, > > > > > > > > > > I've been having syscall spikes. It's really weird. There will be > > > > > >40,000 in 1 second, (according to stats(8)) and it appears at a >