Time spent in kernel mode

Question

I'm new to OS and am learning FreeBSD. I have a question that why ktr uses an offline strategy to generate event logs, by saving events first and providing ktrdump to format and dump them later.

My reasoning is : Since ktr is logging events as the kernel executes, if the task of formatting is also included, that will slow down the kernel and increase the amount of time spent in kernel mode rather than user mode. By using the 2 step process, kernel saves some time, and the task of formatting is done later when the user wants to read the log file.

I want to know if this reason is logical, and if not, why ?

Thanks.

Answer 1

Certainly, formatting strings takes time. If you want to log events that happen frequently enough, you could seriously hamper your system performance.

Similarly, binary logs will take less space than a formatted log. This will both improve performance and allow more data to fit in the ring buffer.