LWN: Comments on "File monitoring with Mortadelo and SystemTap"

Like strace

nix — Fri, 06 Nov 2009 13:42:05 +0000

You can attach to as many as you want as long as you don't want more than
32 :)))

Like strace

oak — Fri, 06 Nov 2009 08:31:00 +0000

> Strace can only trace one manually selected process or process tree.

You can ask strace to attach as many processes with "-p" as you want.

What it doesn't support is both running a process and attaching to processes (some Idi^Hmisguided person filed a bug about that to Debian and they "fixed" it by removing this functionality that's mentioned even in strace manual page. I have a bug of it in Debian).

Like strace

ringerc — Fri, 14 Mar 2008 09:15:14 +0000

It's not really right to suggest that the biggest difference between SystemTap and strace is
the GUI.

Strace can only trace one manually selected process or process tree. That makes it less than
useful once you start to involve D-BUS, HAL, kernel interaction, and other sorts of
inter-process communication.

By contrast, systemtap (and FileMon on Windows) can trace a whole system's actions then filter
out uninteresting data.

I like, and use, both.

My point is that the system-wide aspect of systemtap is a vastly more important difference
between it and strace than the Mortadelo GUI is.

File monitoring with Mortadelo and SystemTap

unaiur — Tue, 11 Mar 2008 19:26:26 +0000

Mortadelo & Filemon is a famous comic here in Spain.
http://www.mortadeloyfilemon.com

Mono vs. Python

kevinbsmith — Sat, 08 Mar 2008 13:35:48 +0000

I'm a Ruby guy, but still enjoyed the Mono/Python thoughts. Especially his final conclusion:

  Overall:
  I'm not writing new programs in C ever again. 

Yes, I know C is great for super-high-performance code, and for super-low-memory (embedded)
footprints, and for writing super-portable libraries. So for any of those, I might consider
it. Fortunately for me, I haven't had to write any of those for about 20 years.

It's hard to imagine a "normal" app that would best be written in C.

File monitoring with Mortadelo and SystemTap

darwish07 — Thu, 06 Mar 2008 22:16:13 +0000

Aha .. Thanks for this great explanation.

File monitoring with Mortadelo and SystemTap

fuhchee — Thu, 06 Mar 2008 13:37:36 +0000

> Is there some redundancy between Audit and SystemTap ?

Sure.  Other than logistical (installation) issues though,
there is the potential for more interesting differences.

Audit is a single system-wide facility, so only a single
configuration (set of trace points) can be active at a time.
Systemtap is per-session, so many different probing sessions
collecting different sorts of data can run at the same time.

Mortadelo represents only a basic use of systemtap at the
present (an unconditional trace record for a bunch of
systemcalls, system-wide).  It could do something richer,
like dynamically adjusting the target process/syscall list
to reduce trace data quantity (-> improve performance, reduce
system impact); to encode user-specified filters; to change
these even during systemtap probe run-time using a /proc file
interface.

Mono and Python

smitty_one_each — Thu, 06 Mar 2008 13:02:38 +0000

There seem to be some hints and allegations of IronPython running on Mono.

File monitoring with Mortadelo and SystemTap

darwish07 — Thu, 06 Mar 2008 10:49:03 +0000

Is there some redundancy between Audit and SystemTap ?

Audit can monitor a system call .. SystemTap does so
Audit can monitor single files .. Again, System tap does so

The uncommon thing now is the ability to audit LSMs by ,say, a MAC subject label and giving
LSMs an easy structure to report violations.

It'll be interesting to see how will they both react once SystemTap gains more popularity.