procmon

Documentation

Index

• Variables
• func ProcEventsMonitor(done <-chan struct{})
• type ProcEvent
  • func NewProcEvent(ev netlink.ProcEvent) ProcEvent
  • func (pe *ProcEvent) IsComm() bool
  • func (pe *ProcEvent) IsExec() bool
  • func (pe *ProcEvent) IsExit() bool
  • func (pe *ProcEvent) IsFork() bool
  • func (pe *ProcEvent) Msg() interface{}
  • func (pe *ProcEvent) Pid() uint32

Variables

var (
	// ProcEventsChannel channel of events to read
	ProcEventsChannel = make(chan ProcEvent)
)

Functions

func ProcEventsMonitor

func ProcEventsMonitor(done <-chan struct{})

ProcEventsMonitor listens for process events from kernel. We listen for events via netlink, from the Process Events Conector: https://lwn.net/Articles/157150/ The kernel must have the options CONFIG_CONECTOR and CONFIG_PROC_EVENTS enabled.

Types

type ProcEvent

type ProcEvent struct {
	TimeStamp uint64
	PID       uint32
	PPID      uint32
	TGID      uint32
	PTGID     uint32
	// contains filtered or unexported fields
}

ProcEvent represents the struct returned from kernel

func NewProcEvent

func NewProcEvent(ev netlink.ProcEvent) ProcEvent

NewProcEvent returns a new event received from kernel

func (*ProcEvent) IsComm

func (pe *ProcEvent) IsComm() bool

IsComm returns if the event is comm

func (*ProcEvent) IsExec

func (pe *ProcEvent) IsExec() bool

IsExec returns if the event is exec

func (*ProcEvent) IsExit

func (pe *ProcEvent) IsExit() bool

IsExit returns if the event is exit

func (*ProcEvent) IsFork

func (pe *ProcEvent) IsFork() bool

IsFork returns if the event is fork

func (*ProcEvent) Msg

func (pe *ProcEvent) Msg() interface{}

Msg returns the message received from netlink

func (*ProcEvent) Pid

func (pe *ProcEvent) Pid() uint32

Pid returns the pid of the event