|
|
To monitor a kernel subsystem, the kernel code is modified in key locations to record events. The modifications are calls to short routines in a ``monitor module'' that declare and fill in an event-specific data structure called an event record, then call the reporting facility to enqueue the event record. The reporting facility allows new event monitoring modules to be added at link time. To add a new event monitoring modules, the module being measured must be modified to include the SURF routines and the kernel must be relinked.
When the monitoring program is not ``consuming'' the event data, the SURF kernel modifications are inactive and the system runs at full production performance. When multiple monitoring modules are configured, the monitoring utility can select the types of events it wants reported. The kernel reports events to a circular kernel buffer that is shared by SURF and the kernel, so the surfd(SURF) monitoring process must run on the same machine as the kernel being monitored. Efficient network communication of events is achieved through the user-space utility that runs on the local machine.