Struct SysEvent 

#[repr(C)]
pub struct SysEvent {
    pub tgid: u32,
    pub host_tgid: u32,
    pub kind: u32,
}

Raw SysEvent ABI — must match eBPF side exactly ABI note: This layout is mirrored in eBPF at ghostscope-process/ebpf/sysmon-bpf/src/lib.rs. We intentionally keep two copies for now to avoid entangling the BPF build with the workspace. Keep repr(C), field order and sizes identical on both sides. Current layout (12 bytes): { tgid: u32, host_tgid: u32, kind: u32 }.

Fields

tgid: u32

Runtime TGID in the configured sysmon event namespace when available.

host_tgid: u32

Host/initial-namespace TGID from bpf_get_current_pid_tgid().

kind: u32

Implementations

impl SysEvent

pub fn event_kind(self) -> Option<SysEventKind>

Trait Implementations

impl Clone for SysEvent

fn clone(&self) -> SysEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SysEvent