Probabilistically Tracking System Calls

Saurabh Goyal (saurabh@cs.wisc.edu)

Akash Lal (akash@cs.wisc.edu)


Abstract:
Monitoring system calls made by an application is useful for debugging, for diagnostics as well as for security applications. Existing tools for monitoring system calls either suffer from a large runtime overhead, or require root permission to change the kernel of the operating system.  We propose an approach that tackles both of these issues. We implemented a tool that runs completely in user space and requires no change to the operating system. It works by probabilistically sampling a few of the system calls made a process, thus lowering its overhead. We show that by using proper sampling techniques, our tool is able to figure out the same information as a tool that tracks all system calls. 

Available as: Postscript or PDF

Software:
Probabilistic-strace source code.
Modified 2.4.27 Linux Kernel.