maurorappa

Check all available kernel tracepoints, for example:

  # cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_adjtimex/format
    name: sys_enter_adjtimex
    ID: 345
    format:
    …..
    field:int common_pid;   offset:4;       size:4; signed:1;

    …..

maurorappa

ifneq ($(KERNELRELEASE),)
   obj-m := proc.o
else

KERNELDIR ?= /lib/modules/$(shell uname -r)/build

PWD := $(shell pwd)
KBUILD_CFLAGS += $(call cc-option,-Wno-error,)

default:

maurorappa

 bpftrace -e 'tracepoint:syscalls:sys_enter_exec*{ printf("pid: %d, comm: %s, args: ", pid, comm); join(args->argv); }

``` 
pid: 2110851, comm: vmxadmin, args: /usr/bin/whoami
pid: 2110853, comm: vmx_status, args: sed -nE s/.*is running.../1/p
pid: 2110854, comm: vmxadmin, args: /usr/bin/whoami
pid: 2110856, comm: vmxadmin, args: grep -q -i release 6 /etc/redhat-release
pid: 2110857, comm: vmx_status, args: grep KALEID_TEST2_PATH= /vmx/install/mauro/server/bin/env-instances.sh
pid: 2110858, comm: vmx_status, args: awk -F = {print $NF}
pid: 2110859, comm: vmx_status, args: sed -E s/\/opt\/tsa\/bin\/([a-z3]+)_packet_decoder.*/\1/

maurorappa

IPMITOOL Utility
#ipmitool lan print 1
Set in Progress         : Set Complete
Auth Type Support       : NONE MD2 MD5 PASSWORD
Auth Type Enable        : Callback : MD2 MD5 PASSWORD
                        : User     : MD2 MD5 PASSWORD
                        : Operator : MD2 MD5 PASSWORD
                        : Admin    : MD2 MD5 PASSWORD

maurorappa

from man adjtimex :

Linux  uses David L. Mills' clock adjustment algorithm (see RFC 1305).  The system call adjtimex() reads and optionally sets adjustment parameters for this algorithm.

on Centos7 , you can use systemtap to monitor who calls this syscall.
you need to install all kernel development and debuginfo packages and only then you can run this:

    #cat clock.stp
    probe kernel.function("sys_adjtimex") { printf("time adjusted by %s(%d)\n",execname(), pid()); }

maurorappa

https://www.ele.uri.edu/research/hpcl/2012/SBAC.pdf


how it compiled:

objdump -s --section .gnu.build.attributes /usr/lib64/liblzo2.so.2.0.0

or check the spec file! face with tongue 

maurorappa

# tshark -r /root/md.pcap -q -n -z dests,tree
Running as user "root" and group "root". This could be dangerous.

=======================================================================================================================================
IPv4 Statistics/Destinations and Ports:
Topic / Item            Count         Average       Min val       Max val       Rate (ms)     Percent       Burst rate    Burst start
---------------------------------------------------------------------------------------------------------------------------------------
Destinations and Ports  127892                                                  12.7895       100%          49.6000       0.075
 222.10.9.3             127892                                                  12.7895       100.00%       49.6000       0.075
  UDP                   127892                                                  12.7895       100.00%       49.6000       0.075

maurorappa

#sqlite3 /var/lib/grafana/grafana.db
 
SQLite version 3.7.17 
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> .output dump.sql
sqlite> .dump dashboard
sqlite> .exit

# tail dump.sql

maurorappa

 bpftrace -e 'tracepoint:syscalls:sys_enter_exec*{ printf("pid: %d, comm: %s, args: ", pid, comm); join(args->argv); }

maurorappa

The kernel creates a thread for every md raid configured:
# ps -ef|grep raid
root         912       2  0 15:24 ?        00:00:00 [raid5wq]
root        3383       2  0 15:24 ?        00:00:00 [md0_raid5]
root        3402       2  0 15:24 ?        00:00:03 [md1_raid5]


Being kernel threads, its management is limited, they cannot be pinned to CPU therefore they can move accross all available CPUs, they can get hammered by IRQ, they might have a 'busy' sibling…
Probably dedicated CPU will provide better performance (testing will follow!).