search

jacereda / fsatrace

Filesystem access tracer
ISC License
78 stars 12 forks source link

Consider ETW on Windows #39

Open ndmitchell opened 3 years ago

ndmitchell commented 3 years ago

https://docs.microsoft.com/en-us/windows/win32/etw/about-event-tracing - not sure if that would be faster or slower than Kernel hooking. There's a chance it might be simpler though. See https://github.com/lowleveldesign/wtrace for an example of building it up to a full tracing app. I measured 21% overhead using fsatrace on Windows (see https://ndmitchell.com/downloads/paper-build_scripts_with_perfect_dependencies-18_nov_2020.pdf S5.2), although some of that will have been spawning the fsatrace binary.

jacereda commented 3 years ago

I fixed a -O0 flag in the makefile not too long ago. Perhaps that measurement was made while the flag was there? 21% seems way too much...

jacereda commented 3 years ago

Also, I haven't seen asserts in a while, maybe it would be a good idea to compile with -DNDEBUG.

jacereda commented 3 years ago

Also, I haven't seen asserts in a while, maybe it would be a good idea to compile with -DNDEBUG.

Looks like there isn't any assert in performance-critical paths...