alarm¶

Intro¶

alarm - set an alarm to be delivered at a specified time

Description¶

alarm sets an alarm to deliver the signal SIGALRM to the calling process in seconds seconds. If seconds is zero, any currently pending alarms are cancelled.

Since the delivery of the signal may be delayed, this function should be used to address any problems related to processes that require a specific timing. However, it should be used with caution, since relying on exact timings can be dangerous and negatively affect the performance of a system if not configured properly.

Arguments¶

seconds:unsigned int[U] - the number of seconds until the alarm is fired.

Available Tags¶

K - Originated from kernel-space.
U - Originated from user space (for example, pointer to user space memory used to get it)
TOCTOU - Vulnerable to TOCTOU (time of check, time of use)
OPT - Optional argument - might not always be available (passed with null value)

Hooks¶

sys_alarm¶

Type¶

Kprobes

Purpose¶

The sys_alarm function is used to hook to obtain the time set for alarm delivery.

Example Use Case¶

This event can be used to monitor applications that require precise timing, as well as for debugging and performance evaluation of applications and services that might be affected by long delay alarms.

Issues¶

The alarm could be interrupted, depending on the system load, so the alarm time might not be delivered precisely on the set time.

SIGCHLD - signal is triggered when a child process of the calling process terminates.
SIGALRM - signal is triggered when an alarm set by the calling process completes.

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.