3 files changed, 9 insertions, 16 deletions

diff --git a/src/deal.go b/src/deal.go
index ae69003..871b7ff 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -191,18 +191,8 @@ func dealExecve(cooked Event) {
 }
 
 func fileOpen(cooked Event) {
-        fmt.Printf("Open: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
-        // 查看是否记录了该进程
-        res, err := pidCol.Finddoc(bson.M{"pid": cooked.pid})
-        if err != nil {
-                fmt.Printf("Error finding pid %d: %v\n", cooked.pid, err)
-        }
-        if len(res) == 0 {
-                // 没找着，滚
-                return
-        }
+        // fmt.Printf("Open: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
 
-        // 确有该进程
         // 权限检查过了，不必再查
         fdCol.InsertOne(bson.M{
                 "timestamp": cooked.timestamp,
@@ -223,7 +213,7 @@ func fileOpen(cooked Event) {
 }
 
 func fileClose(cooked Event) {
-        fmt.Printf("Close: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
+        // fmt.Printf("Close: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
         // 直接看文件表有无记录
         res, err := fdCol.Finddoc(bson.M{
                 "pid":             cooked.pid,
@@ -244,7 +234,7 @@ func fileClose(cooked Event) {
 }
 
 func fileWrite(cooked Event) {
-        fmt.Printf("Write: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
+        // fmt.Printf("Write: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
         // 直接看文件表有无记录
         res, err := fdCol.Finddoc(bson.M{
                 "pid":             cooked.pid,
diff --git a/src/godo.go b/src/godo.go
index cbd9e0a..2ba32d6 100644
--- a/src/godo.go
+++ b/src/godo.go
@@ -37,9 +37,11 @@ func main() {
                 fmt.Printf("Error figuring out syscall numbers: %v\n", err)
         }
 
+        exec.Command("auditctl", "-D").Run()
+        exec.Command("auditctl", "-b", "1000000000").Run()
+        exec.Command("auditctl", "--reset-lost").Run()
+
         var auditCmd *exec.Cmd
-        auditCmd = exec.Command("auditctl", "-D") // 清空所有规则
-        auditCmd.Run()
 
         pidSyscall := []string{"execve"}
         // pidSyscall := []string{"fork", "vfork", "clone", "execve", "exit", "exit_group"}
@@ -50,7 +52,7 @@ func main() {
         }
 
         // 监听文件的消息
-        fileSyscall := []string{"open", "write", "close"}
+        fileSyscall := []string{"open"}
         // fileSyscall := []string{"open", "write", "creat", "unlink", "opendir", "mkdir", "rmdir", "chmod", "fchmod", "chown", "fchown", "lchown", "flock"}
         for i := 0; i < len(fileSyscall); i++ {
                 auditCmd = exec.Command("auditctl", "-a", "exit,always", "-F", "arch=b64", "-S", fileSyscall[i])
diff --git a/src/organize.go b/src/organize.go
index 238509f..8deba53 100644
--- a/src/organize.go
+++ b/src/organize.go
@@ -47,6 +47,7 @@ func orgnaze() {
                         break
                 }
                 rawEvent = raw.(libaudit.RawAuditMessage)
+                // fmt.Printf("type=%v msg=%s\n", rawEvent.Type, rawEvent.Data)
 
                 switch rawEvent.Type {
                 case auparse.AUDIT_SYSCALL: