pdiscover

Documentation

Overview

Go interface to the Linux netlink process connector. See Documentation/connector/connector.txt in the linux kernel source tree.

Index

• Constants
• Variables
• func GetOwnProcPath() (string, error)
• func GetProcInfo(pid int) map[string]string
• func GetProcPath(pid int) (string, error)
• type ProcEventExec
• type ProcEventExit
• type ProcEventFork
• type Watcher
  • func NewAllWatcher(flags uint32) (*Watcher, error)
  • func NewWatcher() (*Watcher, error)
  • func (w *Watcher) Close() error
  • func (w *Watcher) RemoveWatch(pid int) error
  • func (w *Watcher) Watch(pid int, flags uint32) error
  • func (w *Watcher) WatchAll() error

Constants

const (

	// Flags (from <linux/cn_proc.h>)
	PROC_EVENT_FORK = 0x00000001 // fork() events
	PROC_EVENT_EXEC = 0x00000002 // exec() events
	PROC_EVENT_EXIT = 0x80000000 // exit() events

	// Watch for all process events
	PROC_EVENT_ALL = PROC_EVENT_FORK | PROC_EVENT_EXEC | PROC_EVENT_EXIT
)

Variables

var (
	ErrInvalidProcArgsLen = errors.New("invalid ProcArgs length")
	ErrInvalidProcInfo    = errors.New("invalid proc info")
)

Functions

func GetOwnProcPath

func GetOwnProcPath() (string, error)

func GetProcInfo

func GetProcInfo(pid int) map[string]string

func GetProcPath

func GetProcPath(pid int) (string, error)

Types

type ProcEventExec

type ProcEventExec struct {
	Pid int // Pid of the process that called exec()
}

type ProcEventExit

type ProcEventExit struct {
	Pid int // Pid of the process that called exit()
}

type ProcEventFork

type ProcEventFork struct {
	ParentPid int // Pid of the process that called fork()
	ChildPid  int // Child process pid created by fork()
}

type Watcher

type Watcher struct {
	Error chan error          // Errors are sent on this channel
	Fork  chan *ProcEventFork // Fork events are sent on this channel
	Exec  chan *ProcEventExec // Exec events are sent on this channel
	Exit  chan *ProcEventExit // Exit events are sent on this channel
	// contains filtered or unexported fields
}

func NewAllWatcher

func NewAllWatcher(flags uint32) (*Watcher, error)

func NewWatcher

func NewWatcher() (*Watcher, error)

Initialize event listener and channels

func (*Watcher) Close

func (w *Watcher) Close() error

Closes the OS specific event listener, removes all watches and closes all event channels.

func (*Watcher) RemoveWatch

func (w *Watcher) RemoveWatch(pid int) error

Remove pid from the watched process set.

func (*Watcher) Watch

func (w *Watcher) Watch(pid int, flags uint32) error

Add pid to the watched process set. The flags param is a bitmask of process events to capture, must be one or more of: PROC_EVENT_FORK, PROC_EVENT_EXEC, PROC_EVENT_EXIT

func (*Watcher) WatchAll

func (w *Watcher) WatchAll() error