psnotify

README

Process notifications for Go

Overview

The psnotify package captures process events from the kernel via kqueue on Darwin/BSD and the netlink connector on Linux.

The psnotify API is similar to the fsnotify package.

Example:

    watcher, err := psnotify.NewWatcher()
    if err != nil {
        log.Fatal(err)
    }

    // Process events
    go func() {
        for {
            select {
            case ev := <-watcher.Fork:
                log.Println("fork event:", ev)
            case ev := <-watcher.Exec:
                log.Println("exec event:", ev)
            case ev := <-watcher.Exit:
                log.Println("exit event:", ev)
            case err := <-watcher.Error:
                log.Println("error:", err)
            }
        }
    }()

    err = watcher.Watch(os.Getpid(), psnotify.PROC_EVENT_ALL)
    if err != nil {
        log.Fatal(err)
    }

    /* ... do stuff ... */
    watcher.Close()

Supported platforms

Currently targeting modern flavors of Darwin and Linux. Should work on BSD, but untested.

License

Apache 2.0

Documentation

Overview

Go interface to the Linux netlink process connector. See Documentation/connector/connector.txt in the linux kernel source tree.

Index

• Constants
• type ProcEventExec
• type ProcEventExit
• type ProcEventFork
• type Watcher
  • func NewWatcher() (*Watcher, error)
  • func (w *Watcher) Close() error
  • func (w *Watcher) RemoveWatch(pid int) error
  • func (w *Watcher) Watch(pid int, flags uint32) error

Constants

const (

	// Flags (from <linux/cn_proc.h>)
	PROC_EVENT_FORK = 0x00000001 // fork() events
	PROC_EVENT_EXEC = 0x00000002 // exec() events
	PROC_EVENT_EXIT = 0x80000000 // exit() events

	// Watch for all process events
	PROC_EVENT_ALL = PROC_EVENT_FORK | PROC_EVENT_EXEC | PROC_EVENT_EXIT
)

Types

type ProcEventExec

type ProcEventExec struct {
	Pid int // Pid of the process that called exec()
}

type ProcEventExit

type ProcEventExit struct {
	Pid int // Pid of the process that called exit()
}

type ProcEventFork

type ProcEventFork struct {
	ParentPid int // Pid of the process that called fork()
	ChildPid  int // Child process pid created by fork()
}

type Watcher

type Watcher struct {
	Error chan error          // Errors are sent on this channel
	Fork  chan *ProcEventFork // Fork events are sent on this channel
	Exec  chan *ProcEventExec // Exec events are sent on this channel
	Exit  chan *ProcEventExit // Exit events are sent on this channel
	// contains filtered or unexported fields
}

func NewWatcher

func NewWatcher() (*Watcher, error)

Initialize event listener and channels

func (*Watcher) Close

func (w *Watcher) Close() error

Closes the OS specific event listener, removes all watches and closes all event channels.

func (*Watcher) RemoveWatch

func (w *Watcher) RemoveWatch(pid int) error

Remove pid from the watched process set.

func (*Watcher) Watch

func (w *Watcher) Watch(pid int, flags uint32) error

Add pid to the watched process set. The flags param is a bitmask of process events to capture, must be one or more of: PROC_EVENT_FORK, PROC_EVENT_EXEC, PROC_EVENT_EXIT