lttng-dev.lists.lttng.org archive mirror
 help / color / mirror / Atom feed
* Re: Pros and Cons of LTTng
       [not found] <tencent_7588A64434D8A77544C70CAA@qq.com>
@ 2019-07-16 14:28 ` Jonathan Rajotte-Julien
       [not found] ` <20190716142832.GA20789@joraj-alpa>
  1 sibling, 0 replies; 3+ messages in thread
From: Jonathan Rajotte-Julien @ 2019-07-16 14:28 UTC (permalink / raw)
  To: 杨海; +Cc: lttng-dev

Hi Hai,

On Tue, Jul 16, 2019 at 10:19:38AM +0800, 杨海 wrote:
> Obviously LTTng has much lower overhead compared to auditd, when we turn on
> all system calls and use the same load. Is it true for both user space and
> kernel space?

lttng-ust (userspace tracer) mostly use the same concept as the kerneltracer
(per-cpu ring buffers, binary output/CTF, delayed consumption of events, etc.).
There is some penalty for doing things in userspace since we need some
information from the kernel for each tracepoint hit (e.g the current cpu
number). But again most of these hot paths are quite optimized.

In any case I encourage you to try it out on your workload and lttng fit your
needs.

If you do not find a particular feature in the doc [1], do not hesitate to contact
this mailing list for more information.

>So far I haven't seen any report compare LTTng and auditd,
> anyone knows?

I do not remember any conversation on this topic. After reading a bit on auditd,
lttng might be a good replacement depending on your constraints and needs.

[1] https://lttng.org/docs/v2.10/

Cheers
-- 
Jonathan Rajotte-Julien
EfficiOS
_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
https://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev

^ permalink raw reply	[flat|nested] 3+ messages in thread

* [lttng-dev] LTTng container awareness
       [not found] ` <20190716142832.GA20789@joraj-alpa>
@ 2021-05-25  8:13   ` 杨海 via lttng-dev
  0 siblings, 0 replies; 3+ messages in thread
From: 杨海 via lttng-dev @ 2021-05-25  8:13 UTC (permalink / raw)
  To: Jonathan Rajotte-Julien; +Cc: lttng-dev


[-- Attachment #1.1: Type: text/plain, Size: 1909 bytes --]

Hi


LTTng had the 2019 plan to decouple tooling for container awareness, how is the progress on that?
https://archive.fosdem.org/2019/schedule/event/containers_lttng/


As stated in page 18,&nbsp;LTTng is comprised of many components that&nbsp;expect a “monolitic” system. How about the future to containerize the LTTng?




Regards
Hai



&nbsp;
&nbsp;
&nbsp;
------------------&nbsp;Original&nbsp;------------------
From: &nbsp;"Jonathan Rajotte-Julien"<jonathan.rajotte-julien@efficios.com&gt;;
Date: &nbsp;Tue, Jul 16, 2019 10:28 PM
To: &nbsp;"杨海"<hai.yang@magic-shield.com&gt;; 
Cc: &nbsp;"lttng-dev"<lttng-dev@lists.lttng.org&gt;; 
Subject: &nbsp;Re: [lttng-dev] Pros and Cons of LTTng

&nbsp;

Hi Hai,

On Tue, Jul 16, 2019 at 10:19:38AM +0800, 杨海 wrote:
&gt; Obviously LTTng has much lower overhead compared to auditd, when we turn on
&gt; all system calls and use the same load. Is it true for both user space and
&gt; kernel space?

lttng-ust (userspace tracer) mostly use the same concept as the kerneltracer
(per-cpu ring buffers, binary output/CTF, delayed consumption of events, etc.).
There is some penalty for doing things in userspace since we need some
information from the kernel for each tracepoint hit (e.g the current cpu
number). But again most of these hot paths are quite optimized.

In any case I encourage you to try it out on your workload and lttng fit your
needs.

If you do not find a particular feature in the doc [1], do not hesitate to contact
this mailing list for more information.

&gt;So far I haven't seen any report compare LTTng and auditd,
&gt; anyone knows?

I do not remember any conversation on this topic. After reading a bit on auditd,
lttng might be a good replacement depending on your constraints and needs.

[1] https://lttng.org/docs/v2.10/

Cheers
-- 
Jonathan Rajotte-Julien
EfficiOS

[-- Attachment #1.2: Type: text/html, Size: 3057 bytes --]

[-- Attachment #2: Type: text/plain, Size: 156 bytes --]

_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
https://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Pros and Cons of LTTng
@ 2019-07-16  2:19 杨海
  0 siblings, 0 replies; 3+ messages in thread
From: 杨海 @ 2019-07-16  2:19 UTC (permalink / raw)
  To: lttng-dev


[-- Attachment #1.1: Type: text/plain, Size: 265 bytes --]

Hi,


Obviously LTTng has much lower overhead compared to auditd, when we turn on all system calls and use the same load. Is it true for both user space and kernel space?
So far I haven't seen any report compare LTTng and auditd, anyone knows?


Regards
Hai

[-- Attachment #1.2: Type: text/html, Size: 524 bytes --]

[-- Attachment #2: Type: text/plain, Size: 156 bytes --]

_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
https://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-05-25  8:16 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <tencent_7588A64434D8A77544C70CAA@qq.com>
2019-07-16 14:28 ` Pros and Cons of LTTng Jonathan Rajotte-Julien
     [not found] ` <20190716142832.GA20789@joraj-alpa>
2021-05-25  8:13   ` [lttng-dev] LTTng container awareness 杨海 via lttng-dev
2019-07-16  2:19 Pros and Cons of LTTng 杨海

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).