Re: [FS] New monitor framework in 2.6.10?

From: Jan Engelhardt
Date: Mon Nov 15 2004 - 05:24:42 EST

>i'm maintaining a kernel patch which is monitoring file system activity
>underneath a special directory tree and reporting occuring events via a
>character device to userland where it is processed.
>Right now, this patch works via a number of hooks in fs/read-write.c and
>This is not really efficient at the moment because this way I get an event for
>any written block and not per file which can slow things down a lot.
>A couple of days ago I heard rumours about a new feature in 2.6.10 which will
>be exactly for this kind of purpose. Some kind of monitor frameworks that can
>generate events for all sorts of things. Sorry, I don't know any more about

Wasnot it called System Call Auditing and/or Filesystem hooks?

>Is that true?
>Would that be suitable for my task?
>And where can I get information about it?

One or the other was present in SUSE's 2.4.20/.21 kernels and one is in 2.6.x
-- and from what I have seen, they're just hooks, i.e.

if(hook != NULL) { hook(fd, buf, size); }

That's the most efficient thing you can have (in a function). It's only a
question whether it is in the right function, then.

Jan Engelhardt
Gesellschaft fÃr Wissenschaftliche Datenverarbeitung
Am Fassberg, 37077 GÃttingen,
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at