different ways of "communicating" with the kernel sysctl /proc ioctl device file what is a special device file? /dev/dsp, /dev/mixer /dev/sct_ctrl registering file operations with the vfs handling concurrent access kernel/userspace dichotomy (copy to user, copy from user) syscalltrack configuration device file: working. syscalltrack event notifiction device file: single reader/many readers? read only/allow write? supports the following operations (by ioctl): flush ring buffer on overflow lose newest on overflow lose oldest how will notification of events be done, to minimize verbosity and maximize efficiency? what's the best format for notification? current way - variable sized packets what should such a packet contain? all params (process and syscall) or just requested params? just logging, or also notificaton of action performed what's better, read/write or mmap?