Bad file access on the rise

[Doug Ledford]

On 06/08/2013 10:29 AM, Steve Grubb wrote:
> On Saturday, June 08, 2013 10:13:45 AM Doug Ledford wrote:
>> Yes, but none of these results show the .12s time that your first
>> noatime test run showed in your original post.  If you are now saying
>> that atime is faster than noatime by about .005 to .010s, then these
>> results seem to show that.  But your original post was from .019 to .12,
>> or a difference of .10+s.  That was cache load time, not just the
>> syscall difference.
> 
> I chalk that up to the audit system.  The audit system tries real hard to stay 
> out of the way since the vast majority of syscalls are not interesting. But if 
> you trigger an event, it has to get recorded in gory detail and that takes 
> time. (The first run did trigger 5000 audit events, the others didn't.) This is 
> another reason (but not the main reason) we need to try to avoid triggering 
> events in a normally operating machine.

OK, that makes more sense.  So the audit events on a 5000 loop take up
the .10 seconds in time difference.  Fine, I'll grant that this
legitimately belongs in the time difference then.