News for hackers. Stuff that matters.

A comment on Syscall Auditing at Scale. Parent comment

Re:Syscall Auditing at Scale by base698 on Tuesday November 22, 2016 @12:10AM (#13011785)
Is Syscall tracing == perf trace? Ive been doing the same sort of thing with perf. I hadn't heard of the auditing tools.
[ Parent | on HN ]
Re:Syscall Auditing at Scale by amluto on Tuesday November 22, 2016 @12:45AM (#13011908)
Yes, more or less. There are bunch of different "tracing" mechanisms in the kernel, and perf trace is the common way to use it. Syscalls trigger tracepoints, and anything that can see tracepoints can see them. Using eBPF to trace syscalls is probably quite useful.
[ Parent | on HN ]