We have a CentOS 7 system with two user accounts:

  • Sally, to run production jobs.
  • Tanya, for monitoring and interactive jobs.

Sally runs a specific job that Tanya needs to monitor using perf top. Tanya tried running perf top -p PID, but it exits with an error:

You may not have permission to collect stats.
Consider tweaking /proc/sys/kernel/perf_event_paranoid:
 -1 - Not paranoid at all
  0 - Disallow raw tracepoint access for unpriv
  1 - Disallow cpu events for unpriv
  2 - Disallow kernel profiling for unpriv

We set perf_event_paranoid to 0 and -1, but the same error occurred.

Sally is willing to enable monitoring of all of her processes by Tanya. Enabling just this one PID would be OK too (e.g. Sally could run a script every time after starting her process to enable monitoring by Tanya...if only they knew what to write in that script).

If we were discussing GDB, it seems the answer would be gdbserver or sudo. Is there any way to use perf to monitor Sally's jobs without becoming Sally? Sally and Tanya trust each other, but would rather not use impersonation unless absolutely necessary.

  • Perhaps grant CAP_SYS_ADMIN to Tanya? See capabilities(7) and etc.
    – thrig
    Jul 6, 2017 at 14:05
  • @thrig: It seems like CAP_SYS_ADMIN is a very big hammer. It's more or less equivalent to sudo is it not? See lwn.net/Articles/486306 Jul 7, 2017 at 2:31


You must log in to answer this question.

Browse other questions tagged .