Open is well, but we're back to original question.

It's the check(cooked Event) function that causes fileopen crushed,
and now I'am sorry to say that i've forgot why i add this function,
maybe to check ppid and pid in database in just one function but not
the head of each function. However, the check in each function isn't
deleted. I discover it by comparing source code with 5d244e3. In
theory this would only result in the increase of delay. How does it
affect on the fileopen and causes failure? No one knows.

The same to kernel connector. If we still add delay while pid exits,
the connector will say "Error recv: no enough buffer space", but if
we delete the delay, all modules work well. What actually makes the
delay in pid exit causes no enouth buffer of connector? How outra-
geous it is!

Now I've come back to the original question: when i start and use
docker quickly(`start && exec && exit` in just one command), the file
open/write/close is faithfully recorded; but if i use interactive
shell and use vim to change file in docker, nothing happens.

Why? Why? Why?

1 files changed, 4 insertions, 5 deletions

diff --git a/connector/hello.c b/connector/hello.c
index 5240c15..c0fc633 100644
--- a/connector/hello.c
+++ b/connector/hello.c
@@ -8,11 +8,10 @@
 #include <signal.h>
 #include <linux/netlink.h>
 #include <linux/connector.h>
-// #include <linux/cn_proc.h>
+#include <linux/cn_proc.h>
 #include <unistd.h>
 #include <errno.h>
 #include <time.h>
-#include "cn_proc.h"
 
 typedef struct __attribute__((aligned(NLMSG_ALIGNTO)))
 {
@@ -55,16 +54,16 @@ void Now()
 
 void printEvent()
 {
-    union unnamed *procEvent = &proc_msg.proc_ev.event_data;
+    // union unnamed *procEvent = &proc_msg.proc_ev.event_data;
     switch (proc_msg.proc_ev.what)
     {
     case PROC_EVENT_FORK:
         Now();
-        printf("Fork\t%6d\t%6d\t%6d\t%6d\n", procEvent->fork.parent_pid, procEvent->fork.parent_tgid, procEvent->fork.child_pid, procEvent->fork.child_tgid);
+        printf("Fork\t%6d\t%6d\t%6d\t%6d\n", proc_msg.proc_ev.event_data.fork.parent_pid, proc_msg.proc_ev.event_data.fork.parent_tgid, proc_msg.proc_ev.event_data.fork.child_pid, proc_msg.proc_ev.event_data.fork.child_tgid);
         break;
     case PROC_EVENT_EXIT:
         Now();
-        printf("Exit\t%6d\t%6d\t%6d\t%6d\n", procEvent->exit.process_pid, procEvent->exit.process_tgid, procEvent->exit.exit_code, procEvent->exit.exit_signal);
+        printf("Exit\t%6d\t%6d\t%6d\t%6d\n", proc_msg.proc_ev.event_data.exit.process_pid, proc_msg.proc_ev.event_data.exit.process_tgid, proc_msg.proc_ev.event_data.exit.exit_code, proc_msg.proc_ev.event_data.exit.exit_signal);
         break;
     case PROC_EVENT_EXEC:
     default: