README.auditd
1Auditd Daemon
2
3The audit daemon is a simplified version of its desktop
4counterpart designed to gather the audit logs from the
5audit kernel subsystem. The audit subsystem of the kernel
6includes Linux Security Modules (LSM) messages as well.
7
8To enable the audit subsystem, you must add this to your
9kernel config:
10CONFIG_AUDIT=y
11
12To enable a LSM, you must consult that LSM's documentation, the
13example below is for SELinux:
14CONFIG_SECURITY_SELINUX=y
15
16This does not include possible dependencies that may need to be
17satisfied for that particular LSM.
18
README.compression.md
1# Log Compression instead of Chatty in Android S
2
3## The problem
4
5* Log buffer space is precious, but suffers from the tragedy of the commons
6* Log spam fills the buffers making them less useful in logcat/bugreports
7* “Spam” is often in the eye of the beholder: which messages are important depends on what you’re trying to debug
8
9## The idea
10
11* Chatty isn’t helping as much as we’d hoped, and is surprisingly expensive
12* Compress logs to make more efficient use of the buffer
13* Address the root cause of log spam at its source:
14 * Do not hide log spam at runtime, which de-incentivize fixes
15 * Add presubmit coverage similar to SELinux violations to keep log spam down
16
17---
18
19## Chatty in Theory
20
21* Delete messages classified as spam to extend the range of logs from other sources
22* “Spam” defined as:
23 * Logs from UIDs whose logs consume over 12.5% of a log buffer
24 * Back-to-back exact duplicate messages
25
26## Chatty in Practice
27
28* Developer confusion about missing and de-duplicated logs
29* Lowered incentive to fix the root cause of bad logging behavior
30* High CPU overhead
31* Memory usage greatly exceeds configured buffer size
32* Only marginal increase in log range
33
34---
35
36## Log Compression in Theory
37
38* Store many more logs in the same log buffer size => better for diagnosis
39* Memory usage stays below configured log size => better system health
40* No gaps in logs, no de-duplicated logs => no developer confusion
41* No hiding bad behavior => increased accountability/incentive to fix root causes
42
43## Log Compression Preliminary Results
44
45* Captured 2, 5 day periods of full time personal usage of Pixel 4 and replayed the logs offline
46* Compression vs Chatty:
47 * **3.5x more log messages on average**
48 * **50% less CPU usage**
49 * **50% less memory usage**
50
51---
52
53## Log Messages in 1MB
54
55* The number of log messages still available in logcat after ‘Message Count’ messages have been logged to a 1MB log buffer
56* Note: ‘Simple’ is the Chatty code without log spam detection and without de-duplication.
57
58
59
60---
61
62## CPU Time
63
64* Total CPU time on ARM64 (Walleye) and 32bit x86 (Cuttlefish)
65* X axis represents different log buffer size configurations.
66 * Chatty uses significantly more CPU time at 1MB (the default Pixel configuration)
67 * Chatty scales poorly with increased log buffer sizes
68* Note: “simple” isn’t “compression without actually compressing”, it’s “chatty without doing the chatty elimination”, which is why “simple” is more expensive than “compression” on walleye.
69
70
71
72
73---
74
75## Memory Usage
76
77* The memory used by ‘Message Count’ messages, on both Walleye and Cuttlefish
78* Note: Chatty does not consider the metadata (UID, PID, timestamp, etc) in its calculation of log buffer size, so a 1MB log buffer will consume more than 1MB. Note that there are 8 log buffers, 5 of which are typically filled.
79
80
81
82
README.property
1The properties that logd and friends react to are:
2
3name type default description
4ro.logd.auditd bool true Enable selinux audit daemon
5ro.logd.auditd.dmesg bool true selinux audit messages sent to dmesg.
6ro.logd.auditd.main bool true selinux audit messages sent to main.
7ro.logd.auditd.events bool true selinux audit messages sent to events.
8persist.logd.security bool false Enable security buffer.
9ro.organization_owned bool false Override persist.logd.security to false
10ro.logd.kernel bool svelte+ Enable klogd daemon
11ro.debuggable number if not "1", ro.logd.kernel defaults to false.
12logd.logpersistd.enable bool auto Safe to start logpersist daemon service
13logd.logpersistd string persist Enable logpersist daemon, "logcatd"
14 turns on logcat -f in logd context.
15 Responds to logcatd, clear and stop.
16logd.logpersistd.buffer persist logpersistd buffers to collect
17logd.logpersistd.size persist logpersistd size in MB
18logd.logpersistd.rotate_kbytes persist logpersistd outout file size in KB.
19persist.logd.logpersistd string Enable logpersist daemon, "logcatd"
20 turns on logcat -f in logd context.
21persist.logd.logpersistd.buffer all logpersistd buffers to collect
22persist.logd.logpersistd.size 256 logpersistd size in MB
23persist.logd.logpersistd.count 256 sets max number of rotated logs to <count>.
24persist.logd.logpersistd.rotate_kbytes 1024 logpersistd output file size in KB
25persist.logd.size number ro Global default size of the buffer for
26 all log ids at initial startup, at
27 runtime use: logcat -b all -G <value>
28ro.logd.size number svelte default for persist.logd.size. Larger
29 platform default sizes than 256KB are
30 known to not scale well under log spam
31 pressure. Address the spam first,
32 resist increasing the log buffer.
33persist.logd.size.<buffer> number ro Size of the buffer for <buffer> log
34ro.logd.size.<buffer> number svelte default for persist.logd.size.<buffer>
35ro.config.low_ram bool false if true, ro.logd.kernel defaults to false,
36 and (if ro.debuggable is unset/false)
37 logd.size is 64K instead of 256K.
38persist.logd.filter string Pruning filter to optimize content.
39 At runtime use: logcat -P "<string>"
40ro.logd.filter string "~! ~1000/!" default for persist.logd.filter.
41 This default means to prune the
42 oldest entries of chattiest UID, and
43 the chattiest PID of system
44 (1000, or AID_SYSTEM).
45log.tag string persist The global logging level, VERBOSE,
46 DEBUG, INFO, WARN, ERROR, ASSERT or
47 SILENT. Only the first character is
48 the key character.
49persist.log.tag string build default for log.tag
50log.tag.<tag> string persist The <tag> specific logging level.
51persist.log.tag.<tag> string build default for log.tag.<tag>
52
53logd.buffer_type string (empty) The log buffer type: 'simple' or
54 'serialized' (default: 'serialized').
55
56NB:
57- auto - managed by /init
58- svelte - see ro.config.low_ram for details.
59- svelte+ - If empty, default to true if `ro.config.low_ram == false && ro.debuggable == true`
60- ro - <base property> temporary override, ro.<base property> platform default.
61- persist - <base property> override, persist.<base property> platform default.
62- build - VERBOSE for native, DEBUG for jvm isLoggable, or developer option.
63- number - support multipliers (K or M) for convenience. Range is limited
64 to between 64K and 256M for log buffer sizes. Individual log buffer ids
65 such as main, system, ... override global default.
66- Pruning filter rules are specified as UID, UID/PID or /PID. A '~' prefix indicates that elements
67 matching the rule should be pruned with higher priority otherwise they're pruned with lower
68 priority. All other pruning activity is oldest first. Special case ~! represents an automatic
69 pruning for the noisiest UID as determined by the current statistics. Special case ~1000/!
70 represents pruning of the worst PID within AID_SYSTEM when AID_SYSTEM is the noisiest UID.
71
README.replay.md
1logd can record and replay log messages for offline analysis.
2
3Recording Messages
4------------------
5
6logd has a `RecordingLogBuffer` buffer that records messages to /data/misc/logd/recorded-messages.
7It stores messages in memory until that file is accessible, in order to capture all messages since
8the beginning of boot. It is only meant for logging developers to use and must be manually enabled
9in by adding `RecordingLogBuffer.cpp` to `Android.bp` and setting
10`log_buffer = new SimpleLogBuffer(&reader_list, &log_tags, &log_statistics);` in `main.cpp`.
11
12Recording messages may delay the Log() function from completing and it is highly recommended to make
13the logd socket in `liblog` blocking, by removing `SOCK_NONBLOCK` from the `socket()` call in
14`liblog/logd_writer.cpp`.
15
16Replaying Messages
17------------------
18
19Recorded messages can be replayed offline with the `replay_messages` tool. It runs on host and
20device and supports the following options:
21
221. `interesting` - this prints 'interesting' statistics for each of the log buffer types (simple,
23 serialized). The statistics are:
24 1. Log Entry Count
25 2. Size (the uncompressed size of the log messages in bytes)
26 3. Overhead (the total cost of the log messages in memory in bytes)
27 4. Range (the range of time that the logs cover in seconds)
282. `memory_usage BUFFER_TYPE` - this prints the memory usage (sum of private dirty pages of the
29 `replay_messages` process). Note that the input file is mmap()'ed as RO/Shared so it does not
30 appear in these dirty pages, and a baseline is taken before allocating the log buffers, so only
31 their contributions are measured. The tool outputs the memory usage every 100,000 messages.
323. `latency BUFFER_TYPE` - this prints statistics of the latency of the Log() function for the given
33 buffer type. It specifically prints the 1st, 2nd, and 3rd quartiles; the 95th, 99th, and 99.99th
34 percentiles; and the maximum latency.
354. `print_logs BUFFER_TYPE [buffers] [print_point]` - this prints the logs as processed by the given
36 buffer_type from the buffers specified by `buffers` starting after the number of logs specified by
37 `print_point` have been logged. This acts as if a user called `logcat` immediately after the
38 specified logs have been logged. It additionally prints the statistics from `logcat -S` after the
39 logs.
40 `buffers` is a comma separated list of the numeric buffer id values from `<android/log.h>`. For
41 example, `0,1,3` represents the main, radio, and system buffers. It can can also be `all`.
42 `print_point` is an positive integer. If it is unspecified, logs are printed after the entire
43 input file is consumed.
445. `nothing BUFFER_TYPE` - this does nothing other than read the input file and call Log() for the
45 given buffer type. This is used for profiling CPU usage of strictly the log buffer.
46
