Use mongodb, insert process info into it

I failed to print the process tree out. While I'm printing the tree,
the tree itself gets changed, maybe deleted. What's more, the output
show that there are 4 lines with the same ppid and pid, how an absurd
result! It may be caused by multi-thread. So, use database instead.

Mongodb uses bson(binary json) to store data but not relational
database like mysql, which means it's more easy to use.(?)

Beside inserting, I've also solved a question that "fork" is called
once but returns twice. For instance, pid 1 forked pid 2, in the
audit log it's not an event "syscall=clone,ppid=1,pid=2", but actually
two events "syscall=clone,exit=0,ppid=0,pid=1" and "syscall=clone,exit=
2,ppid=0,pid=1", which is just what we see in sys_fork in kernel source.
To deal with this, when syscall is clone and exit is 0 we just drop it.

Left question: To find out the exit code when a process exit/exit_group,
and finish the code to record it in the database.

1 files changed, 35 insertions, 19 deletions

diff --git a/src/organize.go b/src/organize.go
index 025d8c0..bb6736a 100644
--- a/src/organize.go
+++ b/src/organize.go
@@ -23,7 +23,7 @@ func orgnaze() {
         // 为每个事务id存储其信息，事务id在操作系统运行期间是唯一的
         eventTable := make(map[int]*Event)
         // 要用的正则匹配列表
-        syscallRegex := regexp.MustCompile(`audit\((\d+\.\d+):(\d+)\).*?syscall=(\d+).*?ppid=(\d+) pid=(\d+).*?$`)
+        syscallRegex := regexp.MustCompile(`audit\((\d+\.\d+):(\d+)\).*?syscall=(\d+).*?(exit=([-+]?\d+).*?)?ppid=(\d+) pid=(\d+).*?$`)
         execveRegex := regexp.MustCompile(`audit\(\d+\.\d+:(\d+)\): argc=(\d+)`)
         argsRegex := regexp.MustCompile(`a\d+=("(.*?)"|([0-9a-fA-F]+))`)
         cwdRegex := regexp.MustCompile(`audit\(\d+\.\d+:(\d+)\):  cwd="(.*?)"`)
@@ -36,14 +36,6 @@ func orgnaze() {
                 }
                 rawEvent = raw.(libaudit.RawAuditMessage)
 
-                // type Event struct {
-                //      timestamp time.Time
-                //      pid, ppid int
-                //      syscall   int
-                //      argc      int
-                //      args      []string
-                //      cwd       string
-                // }
                 switch rawEvent.Type {
                 case auparse.AUDIT_SYSCALL:
                         if syscallRegex.Match(rawEvent.Data) {
@@ -51,16 +43,40 @@ func orgnaze() {
                                 event.timestamp, err[0] = getTimeFromStr(string(match[1]))
                                 eventId, err[1] = strconv.Atoi(string(match[2]))
                                 event.syscall, err[2] = strconv.Atoi(string(match[3]))
-                                event.ppid, err[3] = strconv.Atoi(string(match[4]))
-                                event.pid, err[4] = strconv.Atoi(string(match[5]))
-                                eventTable[eventId] = &Event{
-                                        timestamp: event.timestamp,
-                                        syscall:   event.syscall,
-                                        ppid:      event.ppid,
-                                        pid:       event.pid,
-                                        argc:      0,
-                                        argv:      make([]string, 0),
-                                        cwd:       "",
+                                var exit int
+                                // exit, err[3] = strconv.Atoi(string(match[4]))
+                                if string(match[5]) == "" {
+                                        // exit没捕获到
+                                        exit = 0
+                                } else {
+                                        exit, err[3] = strconv.Atoi(string(match[5]))
+                                }
+                                event.ppid, err[4] = strconv.Atoi(string(match[5]))
+                                event.pid, err[5] = strconv.Atoi(string(match[6]))
+                                if syscallTable[event.syscall] == "clone" {
+                                        if exit == 0 {
+                                                break
+                                        } else {
+                                                eventTable[eventId] = &Event{
+                                                        timestamp: event.timestamp,
+                                                        syscall:   event.syscall,
+                                                        ppid:      event.pid,
+                                                        pid:       exit,
+                                                        argc:      0,
+                                                        argv:      make([]string, 0),
+                                                        cwd:       "",
+                                                }
+                                        }
+                                } else {
+                                        eventTable[eventId] = &Event{
+                                                timestamp: event.timestamp,
+                                                syscall:   event.syscall,
+                                                ppid:      event.ppid,
+                                                pid:       event.pid,
+                                                argc:      0,
+                                                argv:      make([]string, 0),
+                                                cwd:       "",
+                                        }
                                 }
                         }
                 case auparse.AUDIT_EXECVE: