procevents

Documentation

Overview

Example

package main

import (
	"bytes"
	"fmt"
	"io/ioutil"

	"github.com/ebfe/procevents"
)

func getCommandLine(pid int32) []string {
	buf, err := ioutil.ReadFile(fmt.Sprintf("/proc/%d/cmdline", pid))
	if err != nil {
		return []string{"<unknown>"}
	}
	var cmdline []string
	tok := bytes.Split(buf, []byte{0})
	for _, t := range tok {
		cmdline = append(cmdline, string(t))
	}
	return cmdline
}

func main() {
	conn, err := procevents.Dial()
	if err != nil {
		fmt.Printf("err: %s\n", err)
		return
	}
	defer conn.Close()

	for {
		events, err := conn.Read()
		if err != nil {
			fmt.Printf("err: %s\n", err)
			return
		}
		for _, ev := range events {
			switch ev := ev.(type) {
			case procevents.Exec:
				fmt.Printf("exec: %d %s\n", ev.Pid(), getCommandLine(ev.Pid()))
			case procevents.Exit:
				fmt.Printf("exit: %d (%d)\n", ev.Pid(), ev.Code)
			default:
				/* ignore */
			}
		}
	}
}

Index

• type Comm
• type Conn
  • func Dial() (*Conn, error)
  • func (c *Conn) Close() error
  • func (c *Conn) Read() ([]Event, error)
• type Coredump
• type Event
• type Exec
• type Exit
• type Fork
• type Gid
• type Header
  • func (h Header) Cpu() uint32
  • func (h Header) Pid() int32
  • func (h Header) Tgid() int32
  • func (h Header) Timestamp() uint64
  • func (h Header) What() uint32
• type None
• type Ptrace
• type Sid
• type Uid

Examples

• Package

Types

type Comm

type Comm struct {
	Header
	Comm [16]byte
}

type Conn

type Conn struct {
	// contains filtered or unexported fields
}

func Dial

func Dial() (*Conn, error)

func (*Conn) Close

func (c *Conn) Close() error

func (*Conn) Read

func (c *Conn) Read() ([]Event, error)

type Coredump

type Coredump struct {
	Header
}

type Event

type Event interface {
	What() uint32
	Cpu() uint32
	Timestamp() uint64
	Pid() int32
	Tgid() int32
}

type Exec

type Exec struct {
	Header
}

type Exit

type Exit struct {
	Header
	Code   uint32
	Signal uint32
}

type Fork

type Fork struct {
	Header
	ChildPid  int32
	ChildTgid int32
}

type Gid

type Gid struct {
	Header
	Rgid uint32
	Egid uint32
}

type Header

type Header struct {
	// contains filtered or unexported fields
}

func (Header) Cpu

func (h Header) Cpu() uint32

func (Header) Pid

func (h Header) Pid() int32

func (Header) Tgid

func (h Header) Tgid() int32

func (Header) Timestamp

func (h Header) Timestamp() uint64

func (Header) What

func (h Header) What() uint32

type None

type None struct {
	Header
	Err uint32
}

type Ptrace

type Ptrace struct {
	Header
	TracerPid  int32
	TracerTgid int32
}

type Sid

type Sid struct {
	Header
}

type Uid

type Uid struct {
	Header
	Ruid uint32
	Euid uint32
}