Running the perf sctop script displays syscalls as raw numbers - it would be really helpful to see these as syscall names instead. The message even tells us what to do to get them: root@crownbay:~# perf script sctop # ======== # captured on: Tue Feb 6 06:45:50 2018 # ======== # Install the audit-libs-python package to get syscall names syscall events: event count ---------------------------------------- ---------- 3 12162 5 2138 6 1980 240 1150 4 573 197 116 195 115 220 82 45 75 192 66 174 66 91 40 295 39 13 32 142 19 196 15 140 11 54 7 85 6 265 5 181 5 180 5 221 4 19 3 168 2 125 2 311 1 268 1 202 1 201 1 200 1
Hi Tom, I started to review this bug and found your thread to add perf live mode [1]. After try to use: $ pref trace sctop and $ perf sctop script d It didn't work on master, may be the issue is now invalid since has loaded some years ago. Could you provide me an input? Thanks in advance, alimon [1] https://lwn.net/Articles/381634/
Changing the state to needinfo, because Anibal wants some input from Tom before moving on.
this issue is still valid, I just verified it with 2.3 master You need to install both perf and perf-python and that will provide the sctop script. As pointed out by Tom's initial entry we then need the python bindings for libaudit and libauparse, a quick search in meta-python and layers.openembedded.org did not show those libraries. They are available here: http://people.redhat.com/sgrubb/audit/ Tim (added to Cc) might also know if they are available someplace.
Do we need to add these to OE-core?
http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-security/audit/audit_2.7.bb However, latest upstream version is 2.7.1 I am working on the upgrade recipe, but need to know if we want to add it to core. My gut feeling is yes.
Add meta-selinux maintainer (fray) to CC
Tim, I think yes, we might want to add the audit info as it will help work with the perf which is part of OE-Core already.
I'm looking at the audit 2.7.1 recipe. It has the following: --with-libwrap \ --with-libcap-ng=yes \ --with-python=yes \ --without-python3 \ Does anyone know if we should be building (optionally [pkgconfig] or otherwise) the python3 components for this work? Once the component is configured correctly, then I can help get this back to oe-core if the work is in an acceptable condition.
I think since we do support python3 now it should probably be optionally included via PACKAGECONFIG. This change is probably to late for 2.3, do I am going to move it to 2.4 This is possibly related to fixing Bug 3358 also, so I am going to mark it as blocks that one
I checked that this works with python3 and the syscall names also start coming up as expected after audit, audit-python is installed. Tim, can you still help please move this recipe to OE-core? I am not very sure why --without-python3 is still there ...
meta-selinux has updated to 2.7.6: http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/log/recipes-security/audit/audit_2.7.6.bb I'll try to take a look at the PKGCONFIG in the coming days, but it all depends on fray's buy off on the resulting recipe.
Please note that upstream version is 2.8.2: "The latest is 2.8.2, released Dec 14, 2017." http://people.redhat.com/sgrubb/audit/index.html
Sent to list: http://lists.openembedded.org/pipermail/openembedded-core/2018-March/148102.html
http://git.openembedded.org/openembedded-core/commit/?id=c386abacae89a148e77ffa51630c7917e90406f9