I am running vtune 2022.1 on a centos7 machine to analyze the hotspot consumption of a business process. When I run the hotspot collection, the resulting data file is corrupted. This error occurs many times
Some background info:
$ uname -a
Linux tlinux2-2 3.10.107-1-tlinux2_kvm_guest-0049 #1 SMP Tue Jul 30 23:46:29 CST 2019 x86_64 x86_64 x86_64 GNU/Linux
$ vtune --version
Intel(R) VTune(TM) Profiler 2022.1.0 (build 621966) Command Line Tool
Copyright (C) 2009-2021 Intel Corporation. All rights reserved.
Here is the error:
$ date && vtune -run-pass-thru=--no-altstack -collect hotspots -duration 300 -target-pid 4110 && date
2022-05-09 15:13:20 CST
vtune: Warning: Hardware collection of CPU events is not possible on this system. Microarchitecture performance insights will not be available.
vtune: Collection started. To stop the collection, either press CTRL-C or enter from another console window: vtune -r /data/home/nadoo/data/r001hs -command stop.
vtune: Collection detached.
vtune: Collection stopped.
vtune: Using result path `/data/home/nadoo/data/r001hs'
vtune: Executing actions 12 % Loading '32647-4110.0.trace' file
vtune: Error: Cannot load data file `/data/home/nadoo/data/r001hs/data.0/32647-4110.0.trace' (Data file is corrupted).
vtune: Executing actions 100 % done
vtune: Error: 0x40000025 (Inapplicable report) -- The report 'summary' is not applicable to the result /data/home/nadoo/data/r001hs/r001hs.vtune.
I found that every time this kind of data corruption error occurs, the business process disappears abnormally, by adding an audit rule that audits the kill operation in the audit service:
$ auditctl -a exit,always -F arch=b64 -S kill -S tkill -S tgkill -F a1!=0 -k my_audit_event
Part of the audit log:
$ ausearch -k my_audit_event |grep opid=4110 -C 5 |more
time->Mon May 9 15:13:21 2022
type=OBJ_PID msg=audit(1652080401.960:5240822): opid=4110 oauid=1000 ouid=1000 oses=168341 ocomm="arenasvr"
type=SYSCALL msg=audit(1652080401.960:5240822): arch=c000003e syscall=234 success=yes exit=0 a0=100e a1=100e a2=0 a3=0 items=0 ppid=6267 pid=6290 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=168341 tty=pts5 comm="pinbin" exe="/data/home/nadoo/intel/oneapi/vtune/2022.1.0/bin64/pinbin" key="my_audit_event"
----
time->Mon May 9 15:13:21 2022
type=OBJ_PID msg=audit(1652080401.960:5240823): opid=4110 oauid=1000 ouid=1000 oses=168341 ocomm="arenasvr"
type=SYSCALL msg=audit(1652080401.960:5240823): arch=c000003e syscall=234 success=yes exit=0 a0=100e a1=1183 a2=0 a3=0 items=0 ppid=6267 pid=6290 auid=1000 uid=1000 gid=1000 euid=10
00 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=168341 tty=pts5 comm="pinbin" exe="/data/home/nadoo/intel/oneapi/vtune/2022.1.0/bin64/pinbin" key="my_audit_event"
----
time->Mon May 9 15:13:21 2022
type=OBJ_PID msg=audit(1652080401.960:5240824): opid=4110 oauid=1000 ouid=1000 oses=168341 ocomm="arenasvr"
type=SYSCALL msg=audit(1652080401.960:5240824): arch=c000003e syscall=234 success=yes exit=0 a0=100e a1=1184 a2=0 a3=0 items=0 ppid=6267 pid=6290 auid=1000 uid=1000 gid=1000 euid=10
00 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=168341 tty=pts5 comm="pinbin" exe="/data/home/nadoo/intel/oneapi/vtune/2022.1.0/bin64/pinbin" key="my_audit_event"
----
Through the audit log, I found that the business process exited due to receiving a signal. This process '~/intel/oneapi/vtune/2022.1.0/bin64/pinbin' has many system calls, and system call 234 corresponds to #define __NR_tgkill 234 (reference: cat /usr/include/asm/unistd_64.h),
What is the process of 'pinbin', and why does it issue the command to kill the business process?
