1 files changed, 23 insertions, 22 deletions

diff --git a/src/deal.go b/src/deal.go
index 483d4d2..1dd309c 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -67,17 +67,19 @@ func deal() {
                 case PIDEXIT:
                         go deletePid(cooked)
                 case FILEOPEN:
-                        fileOpen(cooked)
+                        go fileOpen(cooked)
                 case FILEWRITE:
-                        fileWrite(cooked)
+                        go fileWrite(cooked)
                 case FILECLOSE:
-                        fileClose(cooked)
+                        go fileClose(cooked)
                 }
         }
 }
 
 func deletePid(cooked Event) {
-        pidCol.GetLock()
+        if !pidCol.GetLock() {
+                return
+        }
         // 先从老爹那里销户
         pidCol.UpdateOne(bson.M{"pid": cooked.ppid}, bson.M{
                 "$pull": bson.M{
@@ -102,9 +104,9 @@ func deletePid(cooked Event) {
 }
 
 func dealNewPid(cooked Event) {
-        fmt.Printf("Fork: %v\t%6d\t%6d\n", cooked.timestamp, cooked.ppid, cooked.pid)
+        fmt.Printf("Fork\t%6d\t%6d\t%6d\t%6d\n", cooked.ppid, cooked.parentTgid, cooked.pid, cooked.tgid)
         // 有无父进程在观察中
-        docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.ppid})
+        docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.parentTgid})
         if err != nil || len(docRes) != 1 {
                 return
         }
@@ -116,7 +118,9 @@ func dealNewPid(cooked Event) {
                 return
         }
 
-        pidCol.GetLock()
+        if !pidCol.GetLock() {
+                return
+        }
         if len(docRes) != 0 {
                 // 进程原本就存在，换言之别的消息先到了
                 // 所有先行抵达的消息必须保留execve/children字段
@@ -125,7 +129,9 @@ func dealNewPid(cooked Event) {
                 pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
                         "start_timestamp": cooked.timestamp,
                         "ppid":            cooked.ppid,
+                        "parentTgid":      cooked.parentTgid,
                         "pid":             cooked.pid,
+                        "tgid":            cooked.tgid,
                         "cwd":             cooked.cwd,
                         // "execve":          []bson.M{},
                         "args": cooked.argv,
@@ -136,7 +142,9 @@ func dealNewPid(cooked Event) {
                 pidCol.InsertOne(bson.M{
                         "start_timestamp": cooked.timestamp,
                         "ppid":            cooked.ppid,
+                        "parentTgid":      cooked.parentTgid,
                         "pid":             cooked.pid,
+                        "tgid":            cooked.tgid,
                         "cwd":             cooked.cwd,
                         "execve":          []bson.M{},
                         "args":            cooked.argv,
@@ -153,7 +161,6 @@ func dealNewPid(cooked Event) {
 }
 
 func dealExecve(cooked Event) {
-        fmt.Printf("EXEC: %6d\t%6d\n", cooked.ppid, cooked.pid)
         // 父进程在不在？不在扔
         docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.ppid})
         if err != nil || len(docRes) != 1 {
@@ -166,7 +173,9 @@ func dealExecve(cooked Event) {
                 return
         }
 
-        pidCol.GetLock()
+        if !pidCol.GetLock() {
+                return
+        }
         if len(docRes) == 1 {
                 // 自身已在，直接记录
                 pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
@@ -215,22 +224,14 @@ func fileOpen(cooked Event) {
 }
 
 func fileClose(cooked Event) {
-        res, err := fdCol.Finddoc(bson.M{
-                "pid":             cooked.pid,
-                "fd":              cooked.syscallParam[0],
-                "close_timestamp": bson.M{"$exists": false},
-        })
+        res, err := fdCol.FindOneAndDelete(bson.M{"pid": cooked.pid, "fd": cooked.syscallParam[0]})
         if err != nil {
-                fmt.Printf("Err closing fd %d of pid %d: %v\n", cooked.syscallParam[0], cooked.pid, err)
-        }
-        if len(res) == 0 {
                 return
         }
-        fdCol.UpdateOne(bson.M{
-                "pid":             cooked.pid,
-                "fd":              cooked.syscallParam[0],
-                "close_timestamp": bson.M{"$exists": false},
-        }, bson.M{"$set": bson.M{"close_timestamp": cooked.timestamp}})
+        res["close_timestamp"] = cooked.timestamp
+        if err := fileCol.InsertOne(res); err != nil {
+                fmt.Printf("Err inserting files: %v\n", err)
+        }
 }
 
 func fileWrite(cooked Event) {