> At 0:38 -0700 6/17/97, Martin Husemann wrote:
> >> Probably if some part of accounting task is moved to user space, the
> >> chance to lose data may increase.
> >
> >I wonder why accounting is written inside the kernel at all - why not
> >just queue it on some accounting device (like syslog) and drop data
> >whenever the (user configurable) output buffer overflows?
> 
> The process accounting code is old. It's at least as old as 7th Edition
> UNIX (that's where I saw it first, but then I never used V6; it's not in
> the V6 kernel source in the Lion's Book - I just checked), and back then,
> that's how things were done. No one has really felt the need to
> fundamentally change it since then.

Actually, the first implementation of accounting I wrote for NetBSD
queued accounting records for processing by a user-level daemon, which
would then write them out.

That's not particularly efficient ("process exists, it's time to
context switch to the logger!").  It also has a much greater potential
to lose accounting records.  (The current code only loses them when
the disk is full, whereas putting them in user-land means that if some
higher-priority processes are exec'ing and exiting you can lose them
from buffer overflow.  Or, if ther user-land accountant does any
buffering, it could lose the contents of its buffer due to crash.  Or,
at shutdown time, it may lose most of the entries for the processes
running when the shutdown signal is sent.)


chris