Expand connector buffer, put all file info into db

This commit I make several changes, reasons are as follows:
- Expand netlink connector buffer size. Originally it uses only one
  page of mem, but sometimes it causes "no enough buffer" errno, or
  the socket is blocked long time. Now it's 20 pages.
- All file infos are thrown into database. As the last commit co-
  mment, There's 2 tables, "fds" and "files". When a file discriptor
  is closed, the info in fds will be found, delete, and put into the
  "file" table with its close time.

Left questions:
- The netlink connector is always found blocked without any reasons.
  Fix it, or replace the golang-coded connector with C program? The
  key is why it's blocked. Maybe it's in the kernel src code.
- sometimes audit still losts info(not too much). For instance, I
  use vim in the docker to change hello.c, the hello.c may be opened
  but no close info recvd. Or, the swap file of vim, such as
  .hello.c.swp or .hello.c.swx is not closed. What's more, the hello.c
  is never written, but swap files are. May vim write to swap files,
  and replace the origin file? Let's check it.
- Besides, when a pid exits, we should check its file discriptors
  and close them all.

1 files changed, 7 insertions, 6 deletions

diff --git a/src/organize.go b/src/organize.go
index 238509f..5268a90 100644
--- a/src/organize.go
+++ b/src/organize.go
@@ -47,20 +47,21 @@ func orgnaze() {
                         break
                 }
                 rawEvent = raw.(libaudit.RawAuditMessage)
+                fmt.Printf("type=%v msg=%s\n", rawEvent.Type, rawEvent.Data)
 
                 switch rawEvent.Type {
                 case auparse.AUDIT_SYSCALL:
-                        syscallRaw(rawEvent)
+                        go syscallRaw(rawEvent)
                 case auparse.AUDIT_EXECVE:
-                        execve(rawEvent)
+                        go execve(rawEvent)
                 case auparse.AUDIT_CWD:
-                        cwd(rawEvent)
+                        go cwd(rawEvent)
                 case auparse.AUDIT_PATH:
-                        path(rawEvent)
+                        go path(rawEvent)
                 case auparse.AUDIT_PROCTITLE:
-                        proctitle(rawEvent)
+                        go proctitle(rawEvent)
                 case auparse.AUDIT_EOE:
-                        eoe(rawEvent)
+                        go eoe(rawEvent)
                 default:
                         // ATTENTION: 这里也需要做防护
                 }