Struct SysmonConfig 

pub struct SysmonConfig {
    pub target_module: Option<PathBuf>,
    pub proc_offsets_max_entries: u32,
    pub perf_page_count: Option<usize>,
    pub event_mask: SysmonEventMask,
    pub map_change_unfiltered: bool,
    pub watched_pid: Option<u32>,
    pub watched_pid_ns: Option<PidNamespaceId>,
    pub event_pid_ns: Option<PidNamespaceId>,
    pub watched_proc_pid: Option<u32>,
}

Configuration for sysmon

Fields

target_module: Option<PathBuf>

If set, only attempt offsets prefill for events whose binary/module path matches this target.

proc_offsets_max_entries: u32

Maximum number of entries for the pinned proc offsets map (used when ensuring existence).

perf_page_count: Option<usize>

PerfEventArray per-CPU buffer pages (used when ringbuf is unavailable).

event_mask: SysmonEventMask

Internal event selector for the sysmon eBPF side.

map_change_unfiltered: bool

Whether map-change events should be emitted before the PID allowlist is populated.

watched_pid: Option<u32>

Optional event PID to watch. None means system-wide.

watched_pid_ns: Option<PidNamespaceId>

Optional PID namespace for interpreting watched_pid.

event_pid_ns: Option<PidNamespaceId>

Optional PID namespace for reporting target-mode event TGIDs.

watched_proc_pid: Option<u32>

Optional /proc PID corresponding to watched_pid.

Implementations

impl SysmonConfig

pub fn new() -> Self

Trait Implementations

impl Clone for SysmonConfig

fn clone(&self) -> SysmonConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SysmonConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SysmonConfig

fn default() -> Self

Returns the “default value” for a type.