The goal of this project is to record syscall

Sysdig is an awesome tool for capturing syscalls; however, it is too complex and introudces a relatively high overhead.

In our test (the same evluation environment as Performance Evaluation), the average overhead of Sysdig could reach up to 15%!!!

Syscord aims to provide limited features to minimize dependencies and overhead

WARNING: Syscord is still a developing project and all functions have not been fully tested.

Basically, you can make to compile the driver and then insmod syscord.ko to install the kernel module.

Then you could open file /etc/syscall-record/record to find all syscall logs. (You might need to create the directory and delete the file before run)

pid=22569, unknown, res=1
pid=22569, accept4, res=15
pid=22569, epoll_ctl, res=0
pid=22569, epoll_wait, res=1
pid=22569, accept4, res=16
pid=22569, epoll_ctl, res=0
pid=22569, epoll_wait, res=1
pid=22569, accept4, res=17
pid=22569, epoll_ctl, res=0
pid=22569, epoll_wait, res=1
pid=22569, accept4, res=18
pid=22569, epoll_ctl, res=0

• pid: insmod syscord.ko pid=1234
• proc_name: insmod syscord.ko proc_name=test_syscall
• ppid: the parent pid
• parent_proc_name: the process name of parent

All filter conditions can set at the same time

Note: because of the constraint of Linux, we will only compare the first 15 characters of proc_name

sycalls like size_t read(int fd, void *buf, size_t count); might fill the buffer with some (kilo)bytes. Directly recording will inevitably introduce a considerable overhead (~13%), along with a huge record file...

By default, we defined a marco named TRUNCATE_CONTENT_RECORD at syscalls/handlers.h, which means it will only save the first 256 bytes for syscalls like read.

handler function are defined in the end of syscalls/handlers.h. To regitser it to let Syscord know, relavant codes are defined in syscalls/handlers-table.h

For example openat_handle to handle the syscall openat

int openat_handle(struct handler_args* _handler_args) {
  // dirfd = -100 represents AT_FDCWD (the current work directory)
  const int dirfd = _handler_args->saved_entry->arg0;
  const void* pathname = (void*)_handler_args->saved_entry->arg1;
  const int flags = get_arg2(_handler_args->regs);
  const mode_t mode = get_arg3(_handler_args->regs);
  char buf_tmp[ARGS_BUF_SIZE + 1];

  assemble_buf_arg(buf_tmp, pathname, ARGS_BUF_SIZE);
  fast_sprintf(_handler_args->small_buf,
          "pid=%d, openat, dir=%d, path=%s, flags=%d, mode=%u, "
          "res=%d\n",
          current->pid, dirfd, buf_tmp, flags, mode, (int)_handler_args->ret);
  return 0;
}

To bild handlers for specific syscalls, append relevant BIND_HANDLER in void __bind_handlers(void)

void __bind_handlers(void) {
  BIND_HANDLER("getuid", &getuid_handle);
  BIND_HANDLER("recvfrom", &recvfrom_handle);
  BIND_HANDLER("socket", &socket_handle);
  BIND_HANDLER("fstat", &fstat_handle);
  BIND_HANDLER("getcwd", &getcwd_handle);
  BIND_HANDLER("lseek", &lseek_handle);
  BIND_HANDLER("futex", &futex_handle);
  BIND_HANDLER("sendto", &sendto_handle);
  BIND_HANDLER("clone", &clone_handle);
  BIND_HANDLER("read", &read_handle);
  BIND_HANDLER("mmap", &mmap_handle);
  BIND_HANDLER("exit_group", &exit_group_handle);
  BIND_HANDLER("close", &close_handle);
  BIND_HANDLER("tgkill", &tgkill_handle);
  BIND_HANDLER("munmap", &munmap_handle);
  BIND_HANDLER("nanosleep", &nanosleep_handle);
  BIND_HANDLER("ppoll", &ppoll_handle);
  BIND_HANDLER("dup", &dup_handle);
  BIND_HANDLER("ioctl", &ioctl_handle);
  BIND_HANDLER("open", &open_handle);
  BIND_HANDLER("creat", &creat_handle);
  BIND_HANDLER("openat", &openat_handle);
  BIND_HANDLER("close", &close_handle);
  BIND_HANDLER("writev", &writev_handle);
}

tl;dr: the overhead is extremely low (~1%)

• nginx web server (with a complex html page),
• Juno r2 board, with 2 * Cortex-A72 and 4 * Cortex-A53
• test by ab -n 500000 -c 100 http://localhost/, 50 times

A process could issue many times of syscalls with a second, so the trace file can be very large..

The size of the recod file generated by this test is 2.16G (almost 1G/h)

• More syscalls..