1 files changed, 4 insertions, 31 deletions

diff --git a/src/deal.go b/src/deal.go
index 3119fff..ae69003 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -55,31 +55,25 @@ func deal() {
                         break
                 }
 
-                // fmt.Printf("%v\n", cooked)
-
                 switch cooked.tag {
                 case NEWPID:
                         dealNewPid(cooked)
                 case EXECVE:
-                        check(cooked)
                         dealExecve(cooked)
                 case PIDEXIT:
-                        check(cooked)
                         deletePid(cooked)
                 case FILEOPEN:
-                        check(cooked)
                         fileOpen(cooked)
                 case FILEWRITE:
-                        check(cooked)
                         fileWrite(cooked)
                 case FILECLOSE:
-                        check(cooked)
                         fileClose(cooked)
                 }
         }
 }
 
 func deletePid(cooked Event) {
+        // TODO: 是否还需要延时？
         // time.Sleep(1 * time.Second)
         mongoMutex.Lock()
         // 先从老爹那里销户
@@ -197,6 +191,7 @@ func dealExecve(cooked Event) {
 }
 
 func fileOpen(cooked Event) {
+        fmt.Printf("Open: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
         // 查看是否记录了该进程
         res, err := pidCol.Finddoc(bson.M{"pid": cooked.pid})
         if err != nil {
@@ -228,6 +223,7 @@ func fileOpen(cooked Event) {
 }
 
 func fileClose(cooked Event) {
+        fmt.Printf("Close: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
         // 直接看文件表有无记录
         res, err := fdCol.Finddoc(bson.M{
                 "pid":             cooked.pid,
@@ -248,6 +244,7 @@ func fileClose(cooked Event) {
 }
 
 func fileWrite(cooked Event) {
+        fmt.Printf("Write: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
         // 直接看文件表有无记录
         res, err := fdCol.Finddoc(bson.M{
                 "pid":             cooked.pid,
@@ -266,27 +263,3 @@ func fileWrite(cooked Event) {
                 "close_timestamp": bson.M{"$exists": false},
         }, bson.M{"$push": bson.M{"written": cooked.timestamp}})
 }
-
-func check(cooked Event) {
-        // 检查进程是否需要记录
-        // 有无父进程在观察中
-        docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.ppid})
-        if err != nil || len(docRes) != 1 {
-                return
-        }
-
-        // 自身是否已经记录
-        docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.pid})
-        if err != nil {
-                fmt.Printf("Err finding: %v\n", err)
-                return
-        }
-        if len(docRes) == 0 {
-                pidCol.InsertOne(bson.M{
-                        "ppid":            cooked.ppid,
-                        "pid":             cooked.pid,
-                        "children":        []bson.M{},
-                        "start_timestamp": cooked.timestamp,
-                })
-        }
-}