1 files changed, 23 insertions, 25 deletions

diff --git a/src/deal.go b/src/deal.go
index 871b7ff..483d4d2 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -2,20 +2,20 @@ package main
 
 import (
         "fmt"
-        "sync"
         "syscall"
 
         "go.mongodb.org/mongo-driver/bson"
 )
 
 const (
-        dbName     string = "test"
-        pidColName string = "pids"
-        fdColName  string = "fds"
+        dbName      string = "test"
+        pidColName  string = "pids"
+        fdColName   string = "fds"
+        fileColName string = "files"
 )
 
-var mongoMutex sync.Mutex
-var pidCol, fdCol mongoClient
+// var mongoMutex sync.Mutex
+var pidCol, fdCol, fileCol mongoClient
 
 var docRes []bson.M
 var err error
@@ -44,10 +44,14 @@ func deal() {
                 fmt.Printf("Error while initing the mongodb: %v\n", err)
                 return
         }
+        if err = fileCol.init(dbName, fileColName); err != nil {
+                fmt.Printf("Error while initing the mongodb: %v\n", err)
+        }
 
         fmt.Printf("Containerd: %d\n", containerdPid)
         defer pidCol.Disconnect()
         defer fdCol.Disconnect()
+        defer fileCol.Disconnect()
 
         for {
                 cooked, ok = <-cookedChan
@@ -57,11 +61,11 @@ func deal() {
 
                 switch cooked.tag {
                 case NEWPID:
-                        dealNewPid(cooked)
+                        go dealNewPid(cooked)
                 case EXECVE:
-                        dealExecve(cooked)
+                        go dealExecve(cooked)
                 case PIDEXIT:
-                        deletePid(cooked)
+                        go deletePid(cooked)
                 case FILEOPEN:
                         fileOpen(cooked)
                 case FILEWRITE:
@@ -73,9 +77,7 @@ func deal() {
 }
 
 func deletePid(cooked Event) {
-        // TODO: 是否还需要延时？
-        // time.Sleep(1 * time.Second)
-        mongoMutex.Lock()
+        pidCol.GetLock()
         // 先从老爹那里销户
         pidCol.UpdateOne(bson.M{"pid": cooked.ppid}, bson.M{
                 "$pull": bson.M{
@@ -85,7 +87,8 @@ func deletePid(cooked Event) {
 
         // 孩子们需要收容
         // 不必到children里一个个找，直接看ppid即可
-        pidCol.UpdateMany(bson.M{"ppid": cooked.pid}, bson.M{"ppid": 1})
+        // pidCol.UpdateMany(bson.M{"ppid": cooked.pid}, bson.M{"ppid": 1})
+        // 在这套逻辑里，孩子是不需要收容的，因为我们根本就不看ppid来工作
 
         // 可以去死了
         pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
@@ -95,8 +98,7 @@ func deletePid(cooked Event) {
                         "exit_signal":    cooked.exit_signal,
                 },
         })
-        mongoMutex.Unlock()
-        fmt.Printf("Exit: %v\t%6d\t%6d\n", cooked.timestamp, cooked.pid, cooked.exit_code)
+        pidCol.Mutex.Unlock()
 }
 
 func dealNewPid(cooked Event) {
@@ -113,7 +115,8 @@ func dealNewPid(cooked Event) {
                 fmt.Printf("Err finding: %v\n", err)
                 return
         }
-        mongoMutex.Lock()
+
+        pidCol.GetLock()
         if len(docRes) != 0 {
                 // 进程原本就存在，换言之别的消息先到了
                 // 所有先行抵达的消息必须保留execve/children字段
@@ -146,7 +149,7 @@ func dealNewPid(cooked Event) {
                         "children": cooked.pid,
                 },
         })
-        mongoMutex.Unlock()
+        pidCol.Mutex.Unlock()
 }
 
 func dealExecve(cooked Event) {
@@ -162,7 +165,8 @@ func dealExecve(cooked Event) {
         if err != nil {
                 return
         }
-        mongoMutex.Lock()
+
+        pidCol.GetLock()
         if len(docRes) == 1 {
                 // 自身已在，直接记录
                 pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
@@ -187,12 +191,10 @@ func dealExecve(cooked Event) {
                         },
                 })
         }
-        mongoMutex.Unlock()
+        pidCol.Mutex.Unlock()
 }
 
 func fileOpen(cooked Event) {
-        // fmt.Printf("Open: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
-
         // 权限检查过了，不必再查
         fdCol.InsertOne(bson.M{
                 "timestamp": cooked.timestamp,
@@ -213,8 +215,6 @@ func fileOpen(cooked Event) {
 }
 
 func fileClose(cooked Event) {
-        // fmt.Printf("Close: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
-        // 直接看文件表有无记录
         res, err := fdCol.Finddoc(bson.M{
                 "pid":             cooked.pid,
                 "fd":              cooked.syscallParam[0],
@@ -234,8 +234,6 @@ func fileClose(cooked Event) {
 }
 
 func fileWrite(cooked Event) {
-        // fmt.Printf("Write: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
-        // 直接看文件表有无记录
         res, err := fdCol.Finddoc(bson.M{
                 "pid":             cooked.pid,
                 "fd":              cooked.syscallParam[0],