SURF kernel monitor

SURF kernel monitor

SURF provides an efficient means for kernel code to report time-stamped events to a user program. SURF records every event of a specified type with a microsecond timestamp. This information can then be formatted by a user-level process.

To monitor a kernel subsystem, the kernel code is modified in key locations to record events. The modifications are calls to short routines in a ``monitor module'' that declare and fill in an event-specific data structure called an event record, then call the reporting facility to enqueue the event record. The reporting facility allows new event monitoring modules to be added at link time. To add a new event monitoring modules, the module being measured must be modified to include the SURF routines and the kernel must be relinked.

When the monitoring program is not ``consuming'' the event data, the SURF kernel modifications are inactive and the system runs at full production performance. When multiple monitoring modules are configured, the monitoring utility can select the types of events it wants reported. The kernel reports events to a circular kernel buffer that is shared by SURF and the kernel, so the surfd(SURF) monitoring process must run on the same machine as the kernel being monitored. Efficient network communication of events is achieved through the user-space utility that runs on the local machine.

© 2005 The SCO Group, Inc. All rights reserved.