1 files changed, 17 insertions, 13 deletions

diff --git a/src/deal.go b/src/deal.go
index 717344c..3119fff 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -98,12 +98,15 @@ func deletePid(cooked Event) {
                 "$set": bson.M{
                         "exit_timestamp": cooked.timestamp,
                         "exit_code":      cooked.exit_code,
+                        "exit_signal":    cooked.exit_signal,
                 },
         })
         mongoMutex.Unlock()
+        fmt.Printf("Exit: %v\t%6d\t%6d\n", cooked.timestamp, cooked.pid, cooked.exit_code)
 }
 
 func dealNewPid(cooked Event) {
+        fmt.Printf("Fork: %v\t%6d\t%6d\n", cooked.timestamp, cooked.ppid, cooked.pid)
         // 有无父进程在观察中
         docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.ppid})
         if err != nil || len(docRes) != 1 {
@@ -153,6 +156,7 @@ func dealNewPid(cooked Event) {
 }
 
 func dealExecve(cooked Event) {
+        fmt.Printf("EXEC: %6d\t%6d\n", cooked.ppid, cooked.pid)
         // 父进程在不在？不在扔
         docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.ppid})
         if err != nil || len(docRes) != 1 {
@@ -175,19 +179,19 @@ func dealExecve(cooked Event) {
                                 },
                         },
                 })
-                // } else {
-                //      // 先fork抵达，插入
-                //      pidCol.InsertOne(bson.M{
-                //              "ppid":     cooked.ppid,
-                //              "pid":      cooked.pid,
-                //              "children": []bson.M{},
-                //              "execve": []bson.M{
-                //                      {
-                //                              "timestamp": cooked.timestamp,
-                //                              "execArgs":  cooked.argv,
-                //                      },
-                //              },
-                //      })
+        } else {
+                // 先fork抵达，插入
+                pidCol.InsertOne(bson.M{
+                        "ppid":     cooked.ppid,
+                        "pid":      cooked.pid,
+                        "children": []bson.M{},
+                        "execve": []bson.M{
+                                {
+                                        "timestamp": cooked.timestamp,
+                                        "execArgs":  cooked.argv,
+                                },
+                        },
+                })
         }
         mongoMutex.Unlock()
 }