procmon

Documentation

Index

• Constants
• func End()
• func GetPIDFromINode(inode int, inodeKey string) int
• func Init()
• func IsWatcherAvailable() bool
• func SetMonitorMethod(newMonitorMethod string)
• func Start() (err error)
• func Stop() error
• type Inode
• type ProcEntry
• type Process
  • func FindProcess(pid int, interceptUnknown bool) *Process
  • func NewProcess(pid int, path string) *Process
  • func (p *Process) GetInfo() error

Constants

const (
	MethodFtrace = "ftrace"
	MethodProc   = "proc"
	MethodAudit  = "audit"
)

monitor method supported types

Functions

func End

func End()

End stops the way of parsing new connections.

func GetPIDFromINode

func GetPIDFromINode(inode int, inodeKey string) int

GetPIDFromINode tries to get the PID from a socket inode follwing these steps: 1. Get the PID from the cache of Inodes. 2. Get the PID from the cache of PIDs. 3. Look for the PID using one of these methods:

• ftrace: listening processes execs/exits from /sys/kernel/debug/tracing/
• audit: listening for socket creation from auditd.
• proc: search /proc

If the PID is not found by one of the 2 first methods, it'll try it using /proc.

func Init

func Init()

Init starts parsing connections using the method specified.

func IsWatcherAvailable

func IsWatcherAvailable() bool

IsWatcherAvailable checks if ftrace (debugfs) is

func SetMonitorMethod

func SetMonitorMethod(newMonitorMethod string)

SetMonitorMethod configures a new method for parsing connections.

func Start

func Start() (err error)

Start enables the ftrace monitor method. This method configures a kprobe to intercept execve() syscalls. The kernel must have configured and enabled debugfs.

func Stop

func Stop() error

Stop disables ftrace monitor method, removing configured kprobe.

Types

type Inode

type Inode struct {
	Pid    int
	FdPath string
}

Inode represents an item of the InodesCache. the key is formed as follow: inode+srcip+srcport+dstip+dstport

type ProcEntry

type ProcEntry struct {
	Pid         int
	FdPath      string
	Descriptors []string
	Time        time.Time
}

ProcEntry represents an item of the pidsCache

type Process

type Process struct {
	ID          int
	Path        string
	Args        []string
	Env         map[string]string
	CWD         string
	Descriptors []*procDescriptors
	IOStats     *procIOstats
	Status      string
	Stat        string
	Statm       *procStatm
	Stack       string
	Maps        string
}

Process holds the details of a process.

func FindProcess

func FindProcess(pid int, interceptUnknown bool) *Process

FindProcess checks if a process exists given a PID. If it exists in /proc, a new Process{} object is returned with the details to identify a process (cmdline, name, environment variables, etc).

func NewProcess

func NewProcess(pid int, path string) *Process

NewProcess returns a new Process structure.

func (*Process) GetInfo

func (p *Process) GetInfo() error

GetInfo collects information of a process.