aboutsummaryrefslogtreecommitdiffstats
path: root/src/deal.go
diff options
context:
space:
mode:
Diffstat (limited to 'src/deal.go')
-rw-r--r--src/deal.go16
1 files changed, 3 insertions, 13 deletions
diff --git a/src/deal.go b/src/deal.go
index ae69003..871b7ff 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -191,18 +191,8 @@ func dealExecve(cooked Event) {
191} 191}
192 192
193func fileOpen(cooked Event) { 193func fileOpen(cooked Event) {
194 fmt.Printf("Open: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName) 194 // fmt.Printf("Open: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
195 // 查看是否记录了该进程
196 res, err := pidCol.Finddoc(bson.M{"pid": cooked.pid})
197 if err != nil {
198 fmt.Printf("Error finding pid %d: %v\n", cooked.pid, err)
199 }
200 if len(res) == 0 {
201 // 没找着,滚
202 return
203 }
204 195
205 // 确有该进程
206 // 权限检查过了,不必再查 196 // 权限检查过了,不必再查
207 fdCol.InsertOne(bson.M{ 197 fdCol.InsertOne(bson.M{
208 "timestamp": cooked.timestamp, 198 "timestamp": cooked.timestamp,
@@ -223,7 +213,7 @@ func fileOpen(cooked Event) {
223} 213}
224 214
225func fileClose(cooked Event) { 215func fileClose(cooked Event) {
226 fmt.Printf("Close: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName) 216 // fmt.Printf("Close: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
227 // 直接看文件表有无记录 217 // 直接看文件表有无记录
228 res, err := fdCol.Finddoc(bson.M{ 218 res, err := fdCol.Finddoc(bson.M{
229 "pid": cooked.pid, 219 "pid": cooked.pid,
@@ -244,7 +234,7 @@ func fileClose(cooked Event) {
244} 234}
245 235
246func fileWrite(cooked Event) { 236func fileWrite(cooked Event) {
247 fmt.Printf("Write: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName) 237 // fmt.Printf("Write: %6d\t%6d\t%s\n", cooked.ppid, cooked.pid, cooked.pathName)
248 // 直接看文件表有无记录 238 // 直接看文件表有无记录
249 res, err := fdCol.Finddoc(bson.M{ 239 res, err := fdCol.Finddoc(bson.M{
250 "pid": cooked.pid, 240 "pid": cooked.pid,