blob: 7401dc5fa121a1f3ecc89820afa0372c147a1a0f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
package main
import (
"sync"
"time"
)
type eventType int
const (
NEWPID eventType = iota
PIDEXIT
EXECVE
FILEOPEN
FILEWRITE
TYPENUM
)
type Event struct {
tag eventType
timestamp time.Time
pid, ppid int
syscall int
exit_code uint64
argc int
argv []string
cwd string
syscallParam [4]uint64
pathName string
}
func (et eventType) String() string {
names := []string{"NEWPID", "PIDEXIT", "EXECVE", "FILEOPEN", "FILEWRITE", "TYPENUM"}
if et < NEWPID || et > TYPENUM {
return "Unknown"
}
return names[et]
}
var wg sync.WaitGroup // 掌管协程
var rawChan chan interface{} // 从接收到整理的管道
var cookedChan chan Event // 整理好的信息的管道
var syscallTable [500]string //记录一下系统调用
var containerdPid int
|
