1 files changed, 29 insertions, 8 deletions

diff --git a/listener/godo.go b/listener/godo.go
index 8d82231..0e1dc73 100644
--- a/listener/godo.go
+++ b/listener/godo.go
@@ -18,14 +18,15 @@ import (
 
 var (
         fs          = flag.NewFlagSet("audit", flag.ExitOnError)
-        diag        = fs.String("diag", "", "dump raw information from kernel to file")
+        diag        = fs.String("diag", "godo.log", "dump raw information from kernel to file")
         rate        = fs.Uint("rate", 0, "rate limit in kernel (default 0, no rate limit)")
-        backlog     = fs.Uint("backlog", 8192, "backlog limit")
+        backlog     = fs.Uint("backlog", 1<<30, "backlog limit")
         immutable   = fs.Bool("immutable", false, "make kernel audit settings immutable (requires reboot to undo)")
         receiveOnly = fs.Bool("ro", false, "receive only using multicast, requires kernel 3.16+")
+        mongoURI    = fs.String("mongo", "localhost:27017", "mongo database uri")
 )
 
-const bufferPages = 100
+const bufferPages = 1000
 
 func main() {
         // 检查用户身份，并添加auditd规则，监听所有syscall
@@ -41,7 +42,6 @@ func main() {
         }
 
         exec.Command("auditctl", "-D").Run()
-        exec.Command("auditctl", "-b", "1000000000").Run()
         exec.Command("auditctl", "--reset-lost").Run()
 
         var auditCmd *exec.Cmd
@@ -78,24 +78,45 @@ func main() {
         }
 }
 
-func coroutine(client *libaudit.AuditClient) {
+func coroutine(client *libaudit.AuditClient) error {
         // 各协程至此开始
         bufferSize := bufferPages * syscall.Getpagesize()
         rawChan = make(chan interface{}, bufferSize)
         cookedChan = make(chan Event, bufferSize)
 
+        var err error
+        if err = pidCol.init(dbName, pidColName); err != nil {
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
+                return err
+        }
+        if err = initPidCol(); err != nil {
+                fmt.Fprintf(os.Stderr, "Err while initing pidcol: %v\n", err)
+        }
+
+        if err = fdCol.init(dbName, fdColName); err != nil {
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
+                return err
+        }
+        if err = fileCol.init(dbName, fileColName); err != nil {
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
+        }
+
+        defer pidCol.Disconnect()
+        defer fdCol.Disconnect()
+        defer fileCol.Disconnect()
+
+        wg.Add(1)
+        go deal()
         wg.Add(1)
         go procWatch()
-
         wg.Add(1)
         go receive(client)
         wg.Add(1)
         go orgnaze()
-        wg.Add(1)
-        go deal()
 
         wg.Wait()
         time.Sleep(2 * time.Second)
+        return nil
 }
 
 func procWatch() error {