From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050512 Red Hat/1.0.4-1.4.1 Firefox/1.0.4 Description of problem: Performance issues with audit. With audit, we need to convert all the hook functions to use an inline function that checks audit_enable and calls the real audit function only if needed. Version-Release number of selected component (if applicable): kernel-2.6.9-22 How reproducible: Always Steps to Reproduce: 1.boot the kernel 2.turn audit on 3. Actual Results: performance degrade drametically Expected Results: performance not degrade as much. Additional info:
Created attachment 122079 [details] patch to help performance in logging path This patch also avoids some uneccessary variable initialization code.
There was also a technique worked out on the audit mail list to stub the hook functions with inline functions and call the real audit function if audit is enabled. It can be found here: https://www.redhat.com/archives/linux-audit/2005-September/msg00019.html This code has not been developed. It needs to be since its a simple optimization.