processwatcher

README

process-monitor

process-monitor is a Go language library for observing the life cycle of system processes.

Usage

package main

import (
	"fmt"
	"os"
	"os/signal"
	"syscall"

	processwatcher "github.com/merbridge/process-watcher"
)

func main() {
	w := processwatcher.NewProcessWatcher()
	if err := w.Start(); err != nil {
		panic(err)
	}
	sigs := make(chan os.Signal, 1)
	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
	for {
		select {
		case e := <-w.Events():
			if e.Err != nil {
				panic(e.Err)
			}
			typ := "not-support"
			var obj interface{}
			switch e.GetType() {
			case processwatcher.PROC_EVENT_EXEC:
				typ = "exec"
				obj = e.GetExec()
			case processwatcher.PROC_EVENT_FORK:
				typ = "fork"
				obj = e.GetFork()
			case processwatcher.PROC_EVENT_EXIT:
				typ = "exit"
				obj = e.GetExit()
			}
			fmt.Printf("%s: %+v\n", typ, obj)
		case <-sigs:
			return
		}
	}
}

Nit: Requires a root user to run, you can run as: go run -exec sudo ./app

Documentation

Index

• Constants
• type Comm
• type Exec
• type Exit
• type Fork
• type Pid
• type ProcEvent
  • func (p *ProcEvent) GetComm() Comm
  • func (p *ProcEvent) GetExec() Exec
  • func (p *ProcEvent) GetExit() Exit
  • func (p *ProcEvent) GetFork() Fork
  • func (p *ProcEvent) GetHeader() ProcEventHeader
  • func (p *ProcEvent) GetType() ProcEventType
• type ProcEventHeader
• type ProcEventType
• type WatchEvent
• type Watcher
  • func NewProcessWatcher() Watcher

Constants

const (
	CN_IDX_PROC = 1
	CN_VAL_PROC = 1
)

const (
	PROC_EVENT_NONE     ProcEventType = 0x00000000
	PROC_EVENT_FORK                   = 0x00000001
	PROC_EVENT_EXEC                   = 0x00000002
	PROC_EVENT_UID                    = 0x00000004
	PROC_EVENT_GID                    = 0x00000040
	PROC_EVENT_SID                    = 0x00000080
	PROC_EVENT_PTRACE                 = 0x00000100
	PROC_EVENT_COMM                   = 0x00000200
	PROC_EVENT_COREDUMP               = 0x40000000
	PROC_EVENT_EXIT                   = 0x80000000
)

Types

type Comm

type Comm struct {
	ProcessPid  Pid
	ProcessTgid Pid
}

type Exec

type Exec struct {
	ProcessPid  Pid
	ProcessTgid Pid
}

type Exit

type Exit struct {
	ProcessPid  Pid
	ProcessTgid Pid
	ExitCode    uint32
	ExitSignal  uint32
	ParentPid   Pid
	ParentTgid  Pid
}

type Fork

type Fork struct {
	ParentPid  Pid
	ParentTgid Pid
	ChildPid   Pid
	ChildTgid  Pid
}

type Pid

type Pid uint32

type ProcEvent

type ProcEvent struct {
	// contains filtered or unexported fields
}

func (*ProcEvent) GetComm

func (p *ProcEvent) GetComm() Comm

func (*ProcEvent) GetExec

func (p *ProcEvent) GetExec() Exec

func (*ProcEvent) GetExit

func (p *ProcEvent) GetExit() Exit

func (*ProcEvent) GetFork

func (p *ProcEvent) GetFork() Fork

func (*ProcEvent) GetHeader

func (p *ProcEvent) GetHeader() ProcEventHeader

func (*ProcEvent) GetType

func (p *ProcEvent) GetType() ProcEventType

type ProcEventHeader

type ProcEventHeader struct {
	Type ProcEventType
	CPU  uint32
	// Number of nano seconds since system boot
	Timestamps uint64
}

type ProcEventType

type ProcEventType uint32

type WatchEvent

type WatchEvent struct {
	Err error
	ProcEvent
}

type Watcher

type Watcher interface {
	Start() error
	Stop()
	Events() <-chan WatchEvent
}

func NewProcessWatcher

func NewProcessWatcher() Watcher