1 files changed, 92 insertions, 0 deletions

diff --git a/filter/global.go b/filter/global.go
new file mode 100644
index 0000000..45706d4
--- /dev/null
+++ b/filter/global.go
@@ -0,0 +1,92 @@
+package main
+
+import (
+        "fmt"
+        "time"
+)
+
+type Exec struct {
+        Timestamp time.Time `bson:"timestamp"`
+        ExecArgs  []string  `bson:"execArgs"`
+}
+
+type Process struct {
+        Star           bool      `bson:"star"`
+        StartTimestamp time.Time `bson:"start_timestamp"`
+        Ppid           int       `bson:"ppid"`
+        ParentTgid     int       `bson:"parentTgid"`
+        Pid            int       `bson:"pid"`
+        Tgid           int       `bson:"tgid"`
+        Args           []string  `bson:"args"`
+        Comm           string    `bson:"comm"`
+        RootFS         string    `bson:"rootfs"`
+        Cwd            string    `bson:"cwd"`
+        Children       []int     `bson:"children"`
+        Execve         []Exec    `bson:"execve"`
+        ExitCode       int       `bson:"exit_code"`
+        ExitSignal     int       `bson:"exit_signal"`
+        ExitTimestamp  time.Time `bson:"exit_timestamp"`
+}
+
+func (p Process) String() string {
+        var res string
+        res = ""
+        res += fmt.Sprintf("timestamp\t%v\n", p.StartTimestamp)
+        res += fmt.Sprintf("ppid\t%d\nparentTgid\t%d\n", p.Ppid, p.ParentTgid)
+        res += fmt.Sprintf("pid\t%d\ntgid\t%d\nargs: ", p.Pid, p.Tgid)
+        for i := 0; i < len(p.Args); i++ {
+                res += fmt.Sprintf("%s ", p.Args[i])
+        }
+        res += fmt.Sprintf("\ncomm\t%s\ncwd\t%s\n", p.Comm, p.Cwd)
+        if len(p.Execve) != 0 {
+                res += fmt.Sprintf("exec:\n")
+                for i := 0; i < len(p.Execve); i++ {
+                        res += fmt.Sprintf("\ttimestamp: %v\n\texecArgs:\t", p.Execve[i].Timestamp)
+                        for j := 0; j < len(p.Execve[i].ExecArgs); j++ {
+                                res += fmt.Sprintf("%s ", p.Execve[i].ExecArgs[j])
+                        }
+                        res += fmt.Sprintf("\n")
+                }
+        }
+        res += fmt.Sprintf("children: ")
+        for i := 0; i < len(p.Children); i++ {
+                res += fmt.Sprintf("%d ", p.Children[i])
+        }
+        res += fmt.Sprintf("\n")
+        return res
+}
+
+// Queue 定义一个队列结构体
+type Queue struct {
+        items []interface{}
+}
+
+// NewQueue 创建一个新的队列
+func NewQueue() *Queue {
+        return &Queue{items: make([]interface{}, 0)}
+}
+
+// Enqueue 向队列中添加一个元素
+func (q *Queue) Enqueue(item interface{}) {
+        q.items = append(q.items, item)
+}
+
+// Dequeue 从队列中移除并返回队列前面的元素
+func (q *Queue) Dequeue() (interface{}, bool) {
+        if len(q.items) == 0 {
+                return nil, false
+        }
+        item := q.items[0]
+        q.items = q.items[1:]
+        return item, true
+}
+
+// Size 返回队列中的元素数量
+func (q *Queue) Size() int {
+        return len(q.items)
+}
+
+// IsEmpty 检查队列是否为空
+func (q *Queue) IsEmpty() bool {
+        return len(q.items) == 0
+}