Struct ProcessInfo 

pub struct ProcessInfo {
    pub pid: u64,
    pub ppid: u64,
    pub comm: String,
    pub state: ProcessState,
    pub vaddr: u64,
    pub cr3: Option<u64>,
    pub start_time: u64,
}

Information about a Linux process extracted from task_struct.

Fields

pid: u64

Process ID.

ppid: u64

Parent process ID.

comm: String

Process command name (task_struct.comm, max 16 chars).

state: ProcessState

Process state.

vaddr: u64

Virtual address of the task_struct.

cr3: Option<u64>

Page table root (CR3) from mm->pgd, if available.

start_time: u64

Process start time in nanoseconds since boot. Prefers real_start_time (CLOCK_BOOTTIME, includes suspend) for timeline accuracy; falls back to start_time (CLOCK_MONOTONIC) on older kernels. Zero if neither field is in the profile.

Trait Implementations

impl Clone for ProcessInfo

fn clone(&self) -> ProcessInfo

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProcessInfo

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl IntoForensicEvents for ProcessInfo

fn into_forensic_events(self) -> Vec<ForensicEvent>

Consume this value and produce forensic events.