| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This commit I make some changes:
- The filter got mainly finished.
- Build a big node by the same tgid, and use the tgid node to
build th tree we need by bfs.
- Filt relative files, and for the files not closed, add close
time stamp according to the exit time of their pids.
- Put all the results into database.
Besides, I enlarge the buffer size of netlink connector and channels
in lintener.
TODO:
- the pivot_root syscall is used only by the initial shell(`docker
start` makes a shell), other processes of shell change their root
by changing namespace(mnt ns?), using setns syscall. So fix it.
- It's time to fix the netlink connector socket.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
First of all, fix sth in listener to fit the function of filter. Ori-
ginally, listener mark the /usr/bin/containerd process id with star,
but the children in db is updated by ppid, which is pid of parent but
not tgid, so the stared pid has no children. To Fix this, we add all
the pid of /usr/bin/containerd into the db, and set their ptgid/tgid,
so that they're just normal process as others. Maybe we should finish
the info of these processes? haha.
Then, the filter of pid. There're some designed steps to do, and their
methods are as follows:
- Initially, because of the multithreading execution of listener,
there may be several entries for the same process, and we should
merge them. Extract data from database into a slice, and use a map
to record process info. Iterate the slice, if the pid is in the
map, then merge them, else insert into the map.
- Then, we should build process tree, but what we have is pid. So
use another data structure, iterate merged process map, and build
a map from tgid to a slice of processes. Find out the star. Build
a map from pid to its tgid.
- BFS. Design a simple queue, and build the tree from the root(stared
tgid), record all the visited tgid in another map. That's just the
tree.
As usual, let's talk about the remaining issues:
- Some pids did not recieve exit message. Check the exit time of
its tgid, or even its ppid.
- Optimize the data structure, record the tree by itself. Now the
tree is recorded by not only the last helloTree map from tgid to
slice but the map from pid to tgid. It's hard to store in the
database. Design a better ds, so the viewer can build the tree
quickly from the data in db.
- For future file filter, the close time, the same file for the same
pid, and the pathName of a file, should be paid mych attention.
Fighting!
|
|
|
This commit I made several changes:
- Use structure instead of simple bson.M(interface{}). bson.M has
some shortcomings: 1) It makes the database in chaos and hard to
read, but this's not important; 2) Some entrys may has more or
less content than others, which makes it hard to decode and filt.
So I design new data structure to encode and decode. Hopes that
there's no bugs.
- Fix the way to calculate file path. The original method is to add
all the PATH entries together, that's totally wrong! PATH entry
has several types, as it shows in "objtype". I can't find it in
the kernel src code, so what i know is just "PARENT" means the dir
the file is in, while the filename itself has the path, so we
whould ignore all "PARENT"s. When the src code is found, we should
check it again.
- Fix bugs in updating. The update function of mongodb is set to
required to has a '$' such as 'set'/'push', so when we update a
whole doc, we should use replace but not update function. And,
we should never ignore the error infomation it gives us.
Hope that there's no more bugs for this Big Change.
Now its' time to write filter as well as viewer. Best wishes with
NO BUGS!
|
We-unite