mongodb

Documentation

Index

• Constants
• type Event
  • func (e *Event) MarshalJSON() ([]byte, error)
• type Options
• type Parser
  • func (p *Parser) On(ms sniffer.MessageStream)
• type ParserFactory
  • func (pf *ParserFactory) BPFFilter() string
  • func (pf *ParserFactory) New(flow sniffer.IPPortTuple) sniffer.Consumer
• type QCache
  • func (qc *QCache) Add(k int32, v *Event) bool
  • func (qc *QCache) Pop(k int32) (*Event, bool)

Constants

const (
	OP_REPLY        = 1
	OP_MSG          = 1000
	OP_UPDATE       = 2001
	OP_INSERT       = 2002
	RESERVED        = 2003
	OP_QUERY        = 2004
	OP_GET_MORE     = 2005
	OP_DELETE       = 2006
	OP_KILL_CURSORS = 2007
	OP_COMMAND      = 2010
	OP_COMMANDREPLY = 2011
)

Types

type Event

type Event struct {
	ClientIP        string   `json:"client_ip"`
	Collection      string   `json:"collection"`
	CommandType     string   `json:"command_type"`
	Command         document `json:"command"`
	Database        string   `json:"database"`
	DurationMs      float64  `json:"duration_ms"`
	Namespace       string   `json:"namespace"`
	NInserted       int      `json:"ninserted"`
	NormalizedQuery string   `json:"normalized_query,omitempty"`
	NReturned       int32    `json:"nreturned"`
	RequestID       int32    `json:"request_id"`
	RequestLength   int      `json:"request_length"`
	ResponseLength  int      `json:"response_length"`
	ServerIP        string   `json:"server_ip"`
	// contains filtered or unexported fields
}

func (*Event) MarshalJSON

func (e *Event) MarshalJSON() ([]byte, error)

type Options

type Options struct {
	Port         uint16 `long:"port" description:"MongoDB port" default:"27017"`
	ScrubCommand bool   `long:"scrub_command" description:"Apply a one-way hash to command contents"`
}

type Parser

type Parser struct {
	// contains filtered or unexported fields
}

Parser implements sniffer.Consumer

func (*Parser) On

func (p *Parser) On(ms sniffer.MessageStream)

type ParserFactory

type ParserFactory struct {
	Options   Options
	Publisher publish.Publisher
}

ParserFactory implements sniffer.ConsumerFactory TODO: this way of setting things up is kind of confusing

func (*ParserFactory) BPFFilter

func (pf *ParserFactory) BPFFilter() string

func (*ParserFactory) New

func (pf *ParserFactory) New(flow sniffer.IPPortTuple) sniffer.Consumer

type QCache

type QCache struct {
	// contains filtered or unexported fields
}

QCache holds partially-assembled Event structs once we've parsed a request, but need to wait until we see the response to fill in the missing data.

func (*QCache) Add

func (qc *QCache) Add(k int32, v *Event) bool

func (*QCache) Pop

func (qc *QCache) Pop(k int32) (*Event, bool)