1 files changed, 22 insertions, 0 deletions

diff --git a/src/deal.go b/src/deal.go
index d3b5da0..56f6d1d 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -65,6 +65,8 @@ func deal() {
                         go deletePid(cooked)
                 case FILEOPEN:
                         fileOpen(cooked)
+                case FILEWRITE:
+                        fileWrite(cooked)
                 case FILECLOSE:
                         fileClose(cooked)
                 }
@@ -234,3 +236,23 @@ func fileClose(cooked Event) {
                 "close_timestamp": bson.M{"$exists": false},
         }, bson.M{"$set": bson.M{"close_timestamp": cooked.timestamp}})
 }
+
+func fileWrite(cooked Event) {
+        // 直接看文件表有无记录
+        res, err := fdCol.Finddoc(bson.M{
+                "pid":             cooked.pid,
+                "fd":              cooked.syscallParam[0],
+                "close_timestamp": bson.M{"$exists": false},
+        })
+        if err != nil {
+                fmt.Printf("Err closing fd %d of pid %d: %v\n", cooked.syscallParam[0], cooked.pid, err)
+        }
+        if len(res) == 0 {
+                return
+        }
+        fdCol.UpdateOne(bson.M{
+                "pid":             cooked.pid,
+                "fd":              cooked.syscallParam[0],
+                "close_timestamp": bson.M{"$exists": false},
+        }, bson.M{"$push": bson.M{"written": cooked.timestamp}})
+}