Print err in stderr, Find out docker rootfs.collector

When I use godo, error infomation comes along with other output, so
change all err report into stderr. And I listen to `pivot_root` sys-
call to find out the root file system of dockers. However, I'm afraid
of causing too more delay, so don't check rootfs of ppid and record
in the pid. Besides, the method to deal with pivot_root is hardcoded,
which may causes crush.

Shall I listen to the chdir syscall to find out exact cwd? Maybe It's
useful to the pivot_root?

Next step: Find out appropriate data stracture, and add more file
operations to be watched. This task must be completed this week.

1 files changed, 40 insertions, 11 deletions

diff --git a/src/deal.go b/src/deal.go
index f2b7d4b..e553174 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -2,6 +2,7 @@ package main
 
 import (
         "fmt"
+        "os"
         "syscall"
 
         "go.mongodb.org/mongo-driver/bson"
@@ -26,7 +27,7 @@ func deal() {
         var ok bool
 
         if err = pidCol.init(dbName, pidColName); err != nil {
-                fmt.Printf("Error while initing the mongodb: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
                 return
         }
         err = pidCol.InsertOne(bson.M{
@@ -37,16 +38,16 @@ func deal() {
                 "daemon":   true,
         })
         if err != nil {
-                fmt.Printf("Error while initing the mongodb: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
                 return
         }
 
         if err = fdCol.init(dbName, fdColName); err != nil {
-                fmt.Printf("Error while initing the mongodb: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
                 return
         }
         if err = fileCol.init(dbName, fileColName); err != nil {
-                fmt.Printf("Error while initing the mongodb: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
         }
 
         fmt.Printf("Containerd: %d\n", containerdPid)
@@ -73,6 +74,8 @@ func deal() {
                         go fileWrite(cooked)
                 case FILECLOSE:
                         go fileClose(cooked)
+                case PIVOTROOT:
+                        go pivotRoot(cooked)
                 }
         }
 }
@@ -85,9 +88,6 @@ func deletePid(cooked Event) {
                 },
         })
 
-        // 孩子们需要收容
-        // 不必到children里一个个找，直接看ppid即可
-        // pidCol.UpdateMany(bson.M{"ppid": cooked.pid}, bson.M{"ppid": 1})
         // 在这套逻辑里，孩子是不需要收容的，因为我们根本就不看ppid来工作
 
         // 可以去死了
@@ -98,13 +98,15 @@ func deletePid(cooked Event) {
                         "exit_signal":    cooked.exit_signal,
                 },
         })
+
+        // 理论上这里需要关闭所有文件描述符，但为了处理效率，留给后续流程
 }
 
 func dealNewPid(cooked Event) {
         // 自身是否已经记录
         docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.pid})
         if err != nil {
-                fmt.Printf("Err finding: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Err finding: %v\n", err)
                 return
         }
 
@@ -189,7 +191,7 @@ func fileOpen(cooked Event) {
         // 权限检查过了，不必再查
         fdCol.InsertOne(bson.M{
                 "timestamp": cooked.timestamp,
-                "fileName":  cooked.pathName,
+                "fileName":  cooked.srcPath,
                 "pid":       cooked.pid,
                 "fd":        cooked.exit_code,
                 "flags":     cooked.syscallParam,
@@ -212,7 +214,7 @@ func fileClose(cooked Event) {
         }
         res["close_timestamp"] = cooked.timestamp
         if err := fileCol.InsertOne(res); err != nil {
-                fmt.Printf("Err inserting files: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Err inserting files: %v\n", err)
         }
 }
 
@@ -223,7 +225,7 @@ func fileWrite(cooked Event) {
                 "close_timestamp": bson.M{"$exists": false},
         })
         if err != nil {
-                fmt.Printf("Err closing fd %d of pid %d: %v\n", cooked.syscallParam[0], cooked.pid, err)
+                fmt.Fprintf(os.Stderr, "Err closing fd %d of pid %d: %v\n", cooked.syscallParam[0], cooked.pid, err)
         }
         if len(res) == 0 {
                 return
@@ -234,3 +236,30 @@ func fileWrite(cooked Event) {
                 "close_timestamp": bson.M{"$exists": false},
         }, bson.M{"$push": bson.M{"written": cooked.timestamp}})
 }
+
+func pivotRoot(cooked Event) {
+        // docker的根目录信息，记录
+        docRes, err := pidCol.Finddoc(bson.M{"pid": cooked.pid})
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "Err finding: %v\n", err)
+                return
+        }
+
+        if len(docRes) == 0 {
+                // fork还没到，等一下
+                pidCol.InsertOne(bson.M{
+                        "start_timestamp": cooked.timestamp,
+                        "ppid":            cooked.ppid,
+                        "pid":             cooked.pid,
+                        "rootfs":          "cwd",
+                })
+        } else {
+                // 读取已有的工作目录
+                cwd := docRes[0]["cwd"]
+                pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
+                        "$set": bson.M{
+                                "rootfs": cwd,
+                        },
+                })
+        }
+}