blob: 11b18bf8ba8b962860796143299c9f3e453a4e5d (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
package main
import (
"sync"
"time"
)
type eventType int
const (
NEWPID eventType = iota
PIDEXIT
EXECVE
FILEOPEN
FILECLOSE
FILEWRITE
PIVOTROOT
TYPENUM
)
func (et eventType) String() string {
names := []string{"NEWPID", "PIDEXIT", "EXECVE", "FILEOPEN", "FILECLOSE", "FILEWRITE", "PIVOTROOT", "TYPENUM"}
if et < NEWPID || et > TYPENUM {
return "Unknown"
}
return names[et]
}
type Event struct {
tag eventType
timestamp time.Time
pid, tgid int
ppid, parentTgid int
syscall int
syscallParam [4]uint64
argc int
argv []string
comm string
cwd string
exit_code int
exit_signal int
srcPath string
destPath string
}
var wg sync.WaitGroup // 掌管协程
var rawChan chan interface{} // 从接收到整理的管道
var cookedChan chan Event // 整理好的信息的管道
var syscallTable [500]string //记录一下系统调用
var containerdPid int
// 插入到数据库的结构
type Exec struct {
Timestamp time.Time `bson:"timestamp"`
ExecArgs []string `bson:"execArgs"`
}
type Process struct {
Star bool `bson:"star"`
StartTimestamp time.Time `bson:"start_timestamp"`
Ppid int `bson:"ppid"`
ParentTgid int `bson:"parentTgid"`
Pid int `bson:"pid"`
Tgid int `bson:"tgid"`
Args []string `bson:"args"`
Comm string `bson:"comm"`
RootFS string `bson:"rootfs"`
Cwd string `bson:"cwd"`
Children []int `bson:"children"`
Execve []Exec `bson:"execve"`
ExitCode int `bson:"exit_code"`
ExitSignal int `bson:"exit_signal"`
ExitTimestamp time.Time `bson:"exit_timestamp"`
}
type File struct {
OpenTimestamp time.Time `bson:"timestamp"`
FileName string `bson:"fileName"`
Pid int `bson:"pid"`
Fd int `bson:"fd"`
Flags [4]uint64 `bson:"flags"`
Written []time.Time `bson:"written"`
CloseTimestamp time.Time `bson:"close_timestamp"`
}
|
