diff options
Diffstat (limited to 'src/deal.go')
-rw-r--r-- | src/deal.go | 16 |
1 files changed, 3 insertions, 13 deletions
diff --git a/src/deal.go b/src/deal.go index ae69003..871b7ff 100644 --- a/src/deal.go +++ b/src/deal.go | |||
@@ -191,18 +191,8 @@ func dealExecve(cooked Event) { | |||
191 | } | 191 | } |
192 | 192 | ||
193 | func fileOpen(cooked Event) { | 193 | func fileOpen(cooked Event) { |
194 | fmt.Printf("Open: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName) | 194 | // fmt.Printf("Open: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName) |
195 | // 查看是否记录了该进程 | ||
196 | res, err := pidCol.Finddoc(bson.M{"pid": cooked.pid}) | ||
197 | if err != nil { | ||
198 | fmt.Printf("Error finding pid %d: %v\n", cooked.pid, err) | ||
199 | } | ||
200 | if len(res) == 0 { | ||
201 | // 没找着,滚 | ||
202 | return | ||
203 | } | ||
204 | 195 | ||
205 | // 确有该进程 | ||
206 | // 权限检查过了,不必再查 | 196 | // 权限检查过了,不必再查 |
207 | fdCol.InsertOne(bson.M{ | 197 | fdCol.InsertOne(bson.M{ |
208 | "timestamp": cooked.timestamp, | 198 | "timestamp": cooked.timestamp, |
@@ -223,7 +213,7 @@ func fileOpen(cooked Event) { | |||
223 | } | 213 | } |
224 | 214 | ||
225 | func fileClose(cooked Event) { | 215 | func fileClose(cooked Event) { |
226 | fmt.Printf("Close: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName) | 216 | // fmt.Printf("Close: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName) |
227 | // 直接看文件表有无记录 | 217 | // 直接看文件表有无记录 |
228 | res, err := fdCol.Finddoc(bson.M{ | 218 | res, err := fdCol.Finddoc(bson.M{ |
229 | "pid": cooked.pid, | 219 | "pid": cooked.pid, |
@@ -244,7 +234,7 @@ func fileClose(cooked Event) { | |||
244 | } | 234 | } |
245 | 235 | ||
246 | func fileWrite(cooked Event) { | 236 | func fileWrite(cooked Event) { |
247 | fmt.Printf("Write: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName) | 237 | // fmt.Printf("Write: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName) |
248 | // 直接看文件表有无记录 | 238 | // 直接看文件表有无记录 |
249 | res, err := fdCol.Finddoc(bson.M{ | 239 | res, err := fdCol.Finddoc(bson.M{ |
250 | "pid": cooked.pid, | 240 | "pid": cooked.pid, |