-
Notifications
You must be signed in to change notification settings - Fork 7
Open
Labels
Description
From the beginning, tracexec is implemented as a troubleshooting tool that isn't designed to run for a long time.
- It keeps all the events in memory and does not release them.
- The usage of hash map of
ArcStrfor string de-duplication also cannot release unused strings due to lack of week variant ofArcStr
It might be useful to run tracexec in daemon mode to continuously collect exec events.
To achieve that, we need to
- Replace hashmap of
ArcStrwith a string interning library. - Implement daemon mode and add a systemd service