audit

Documentation

Index

• type SysCallListener
  • func NewSysCallListener(config *settings.Settings, procMover cgroups.ProcessMover, ...) *SysCallListener
  • func (scl *SysCallListener) Loop()

Types

type SysCallListener

type SysCallListener struct {
	// contains filtered or unexported fields
}

SysCallListener instances can declare and listen for audit events.

func NewSysCallListener

func NewSysCallListener(config *settings.Settings, procMover cgroups.ProcessMover, procRunner triggers.ProcessRunner) *SysCallListener

NewSysCallListener creates and initializes a SysCallListener instance

func (*SysCallListener) Loop

func (scl *SysCallListener) Loop()

Loop listen for audit events from kernel and act accordlingly. This method never returns.