Re:Syscall Auditing at Scale
by amluto on Tuesday November 22, 2016 @12:45AM
(#13011908)
Yes, more or less. There are bunch of different "tracing" mechanisms in the kernel, and perf trace is the common way to use it. Syscalls trigger tracepoints, and anything that can see tracepoints can see them. Using eBPF to trace syscalls is probably quite useful.
[ Parent
| on HN ]
There are no comments on this comment yet.