Use mongodb, insert process info into it

I failed to print the process tree out. While I'm printing the tree,
the tree itself gets changed, maybe deleted. What's more, the output
show that there are 4 lines with the same ppid and pid, how an absurd
result! It may be caused by multi-thread. So, use database instead.

Mongodb uses bson(binary json) to store data but not relational
database like mysql, which means it's more easy to use.(?)

Beside inserting, I've also solved a question that "fork" is called
once but returns twice. For instance, pid 1 forked pid 2, in the
audit log it's not an event "syscall=clone,ppid=1,pid=2", but actually
two events "syscall=clone,exit=0,ppid=0,pid=1" and "syscall=clone,exit=
2,ppid=0,pid=1", which is just what we see in sys_fork in kernel source.
To deal with this, when syscall is clone and exit is 0 we just drop it.

Left question: To find out the exit code when a process exit/exit_group,
and finish the code to record it in the database.

1 files changed, 22 insertions, 1 deletions

diff --git a/src/global.go b/src/global.go
index 4e08866..0439df6 100644
--- a/src/global.go
+++ b/src/global.go
@@ -1,6 +1,27 @@
 package main
 
-import "sync"
+import (
+        "sync"
+        "time"
+)
+
+type Event struct {
+        timestamp time.Time
+        pid, ppid int
+        syscall   int
+        argc      int
+        argv      []string
+        cwd       string
+}
+
+type process struct {
+        timestamp time.Time
+        pid, ppid int
+        argv      []string
+        cwd       string
+        rootfs    string
+        children  []int
+}
 
 var pids sync.Map            // 古希腊掌管进程的神，int->*process
 var wg sync.WaitGroup        // 掌管协程