Probabilistically Tracking System Calls
Saurabh Goyal (saurabh@cs.wisc.edu)
Akash Lal (akash@cs.wisc.edu)
Abstract:
Monitoring system calls made by an
application is useful for debugging,
for diagnostics as well as for security applications. Existing tools
for monitoring system calls either suffer from a large runtime
overhead, or require root permission to change the kernel of the
operating system. We propose an approach that
tackles both of these issues. We implemented a tool that runs
completely in user space and requires
no change to the operating system. It works by probabilistically
sampling a few of the system calls made a process, thus lowering its
overhead. We show that by using proper sampling techniques, our tool is
able to figure out the same information as a tool that tracks all
system calls.
Available as:
Postscript or
PDF
Software:
Probabilistic-strace source code.
Modified 2.4.27 Linux Kernel.