3 files changed, 32 insertions, 7 deletions

diff --git a/listener/deal.go b/listener/deal.go
index 8225224..70c2827 100644
--- a/listener/deal.go
+++ b/listener/deal.go
@@ -79,19 +79,19 @@ func deal() {
 
                 switch cooked.tag {
                 case NEWPID:
-                        go dealNewPid(cooked)
+                        dealNewPid(cooked)
                 case EXECVE:
-                        go dealExecve(cooked)
+                        dealExecve(cooked)
                 case PIDEXIT:
-                        go deletePid(cooked)
+                        deletePid(cooked)
                 case FILEOPEN:
-                        go fileOpen(cooked)
+                        fileOpen(cooked)
                 case FILEWRITE:
-                        go fileWrite(cooked)
+                        fileWrite(cooked)
                 case FILECLOSE:
-                        go fileClose(cooked)
+                        fileClose(cooked)
                 case PIVOTROOT:
-                        go pivotRoot(cooked)
+                        pivotRoot(cooked)
                 }
         }
 }
@@ -131,6 +131,7 @@ func dealNewPid(cooked Event) {
                 docRes[0].Cwd = cooked.cwd
                 docRes[0].Comm = cooked.comm
                 docRes[0].Args = cooked.argv
+                docRes[0].DockerId = cooked.cgroup
 
                 err := pidCol.ReplaceOne(bson.M{"pid": cooked.pid}, docRes[0])
                 if err != nil {
@@ -149,6 +150,7 @@ func dealNewPid(cooked Event) {
                         Cwd:            cooked.cwd,
                         Execve:         make([]Exec, 0),
                         Children:       make([]int, 0),
+                        DockerId:       cooked.cgroup,
                 })
                 if err != nil {
                         fmt.Fprintf(os.Stderr, "Err inserting: %v\n", err)
diff --git a/listener/global.go b/listener/global.go
index 11b18bf..b782284 100644
--- a/listener/global.go
+++ b/listener/global.go
@@ -37,6 +37,7 @@ type Event struct {
         argv             []string
         comm             string
         cwd              string
+        cgroup           string
         exit_code        int
         exit_signal      int
         srcPath          string
@@ -67,6 +68,7 @@ type Process struct {
         RootFS         string    `bson:"rootfs"`
         Cwd            string    `bson:"cwd"`
         Children       []int     `bson:"children"`
+        DockerId       string    `bson:"docker_id"`
         Execve         []Exec    `bson:"execve"`
         ExitCode       int       `bson:"exit_code"`
         ExitSignal     int       `bson:"exit_signal"`
diff --git a/listener/godo.go b/listener/godo.go
index 87e9446..8d82231 100644
--- a/listener/godo.go
+++ b/listener/godo.go
@@ -8,6 +8,7 @@ import (
         "netlink"
         "os"
         "os/exec"
+        "regexp"
         "strings"
         "syscall"
         "time"
@@ -176,4 +177,24 @@ func checkProc(pCooked *Event) {
                 fmt.Fprintf(os.Stderr, "Err: %v\n", err)
                 pCooked.cwd = ""
         }
+
+        fd, err = os.Open(fileName + "cgroup")
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "Err: %v\n", err)
+                // cgroup记空，即没赶上
+                return
+        }
+        scanner = bufio.NewScanner(fd)
+        cgroupRegex := regexp.MustCompile(`/docker/([0-9a-f]+)$`)
+        scanner.Split(bufio.ScanLines)
+        for scanner.Scan() {
+                line := scanner.Text()
+                if cgroupRegex.MatchString(line) {
+                        match := cgroupRegex.FindStringSubmatch(line)
+                        pCooked.cgroup = match[1]
+                        return
+                }
+        }
+        fd.Close()
+        pCooked.cgroup = ""
 }