1 files changed, 0 insertions, 31 deletions

diff --git a/src/organize.go b/src/organize.go
index d7a1df1..238509f 100644
--- a/src/organize.go
+++ b/src/organize.go
@@ -47,7 +47,6 @@ func orgnaze() {
                         break
                 }
                 rawEvent = raw.(libaudit.RawAuditMessage)
-                fmt.Printf("type=%v msg=%s\n", rawEvent.Type, rawEvent.Data)
 
                 switch rawEvent.Type {
                 case auparse.AUDIT_SYSCALL:
@@ -100,24 +99,6 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) {
         }
 
         switch syscallTable[event.syscall] {
-        case "clone":
-                if exit == 0 || event.pid > exit {
-                        // exit=0是给新进程的返回，没用
-                        // pid>exit，证明有问题，抛弃
-                        break
-                } else {
-                        eventTable.Store(eventId, &Event{
-                                tag:       NEWPID,
-                                timestamp: event.timestamp,
-                                syscall:   event.syscall,
-                                exit_code: 0,
-                                ppid:      event.pid,
-                                pid:       exit,
-                                argc:      0,
-                                argv:      make([]string, 0),
-                                cwd:       "",
-                        })
-                }
         case "execve":
                 eventTable.Store(eventId, &Event{
                         tag:       EXECVE,
@@ -130,18 +111,6 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) {
                         argv:      make([]string, 0),
                         cwd:       "",
                 })
-        case "exit", "exit_group":
-                eventTable.Store(eventId, &Event{
-                        tag:       PIDEXIT,
-                        timestamp: event.timestamp,
-                        syscall:   event.syscall,
-                        exit_code: a[0],
-                        ppid:      event.ppid,
-                        pid:       event.pid,
-                        argc:      0,
-                        argv:      make([]string, 0),
-                        cwd:       "",
-                })
         case "open":
                 // 检查打开的权限
                 if a[1]&(syscall.O_APPEND|syscall.O_WRONLY|syscall.O_RDWR|syscall.O_TRUNC) == 0 {