1 files changed, 5 insertions, 3 deletions

diff --git a/src/godo.go b/src/godo.go
index cbd9e0a..2ba32d6 100644
--- a/src/godo.go
+++ b/src/godo.go
@@ -37,9 +37,11 @@ func main() {
                 fmt.Printf("Error figuring out syscall numbers: %v\n", err)
         }
 
+        exec.Command("auditctl", "-D").Run()
+        exec.Command("auditctl", "-b", "1000000000").Run()
+        exec.Command("auditctl", "--reset-lost").Run()
+
         var auditCmd *exec.Cmd
-        auditCmd = exec.Command("auditctl", "-D") // 清空所有规则
-        auditCmd.Run()
 
         pidSyscall := []string{"execve"}
         // pidSyscall := []string{"fork", "vfork", "clone", "execve", "exit", "exit_group"}
@@ -50,7 +52,7 @@ func main() {
         }
 
         // 监听文件的消息
-        fileSyscall := []string{"open", "write", "close"}
+        fileSyscall := []string{"open"}
         // fileSyscall := []string{"open", "write", "creat", "unlink", "opendir", "mkdir", "rmdir", "chmod", "fchmod", "chown", "fchown", "lchown", "flock"}
         for i := 0; i < len(fileSyscall); i++ {
                 auditCmd = exec.Command("auditctl", "-a", "exit,always", "-F", "arch=b64", "-S", fileSyscall[i])