On Wed, Apr 16, 2014 at 02:27:50PM -0700, Henry Hallam wrote:
Hi, my name is Henry and I'm a kernel newbie.
Hello, Henry.
Recently plagued by a perplexing issue where *something* would step the clock on an important server by exactly 5 minutes at infrequent, unpredictable intervals, I put together my first kernel module - a trivial hook into do_settimeofday via a jprobe, that prints the PID, process name and time adjustment to the kernel message log.
Here's what I have so far: https://github.com/henryhallam/timepolice
Questions:
1. Is a module using kprobes/jprobes the right way to do it, vs adding printks to linux/time/timekeeping.c?
Have you taken a look at the various kernel tracing features? I suspect you could do exactly what you want without modifying the kernel at all using the function tracer. Josh