Hi, my name is Henry and I'm a kernel newbie. Recently plagued by a perplexing issue where *something* would step the clock on an important server by exactly 5 minutes at infrequent, unpredictable intervals, I put together my first kernel module - a trivial hook into do_settimeofday via a jprobe, that prints the PID, process name and time adjustment to the kernel message log. Here's what I have so far: https://github.com/henryhallam/timepolice Questions: 1. Is a module using kprobes/jprobes the right way to do it, vs adding printks to linux/time/timekeeping.c? 2. If a module is the way to go, would it be better to create a read/write /proc entry to allow enabling and disabling, rather than inserting the module to enable and removing to disable? 3. Is this sort of thing worth submitting to mainline? What are the next steps for that, after choosing a better name, changing the silly load/unload messages and ensuring it passes checkpatch.pl? Thanks!