Performance of libauparse

[Matthew Booth]

I have been investigating using libauparse in my austream replacement 
audit daemon to do some inline data enhancement[1]. austream is 
essentially a very thin wrapper which pulls audit records out of the 
kernel, wraps them in a UDP syslog packet and sends them to the network. 
It is very simple and very fast.

To measure the overhead of libauparse on austream I initialised auparse 
  as AUSOURCE_FEED, fed each received record into it, and spat them out 
unmodified on receiving the AUPARSE_CB_EVENT_READY event. This added 
more than an order of magnitude to the time austream spends in 
userspace. A brief look at this overhead shows that about 40% is spent 
in malloc()/free(), and 25% is spent in strlen, strdup, memcpy, memmove 
and friends. I suspect that very substantial gains could be made in the 
performance of libauparse by reworking the way it uses memory, and 
passing the length of strings around with the strings. Unfortunately, I 
suspect this would amount to a substantial rewrite.

Is this something anybody else is interested in? I guess performance 
isn't so important if you're just scanning log files in non-real time.

Matt

[1] What I'd really like is a well-defined binary format from the kernel.
-- 
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490