Enum ProcEvent 

pub enum ProcEvent {
    Exec {
        pid: u32,
        tgid: u32,
    },
    Fork {
        parent_pid: u32,
        parent_tgid: u32,
        child_pid: u32,
        child_tgid: u32,
    },
    Exit {
        pid: u32,
        tgid: u32,
        exit_code: u32,
        exit_signal: u32,
    },
    Uid {
        pid: u32,
        tgid: u32,
        ruid: u32,
        euid: u32,
    },
    Gid {
        pid: u32,
        tgid: u32,
        rgid: u32,
        egid: u32,
    },
    Sid {
        pid: u32,
        tgid: u32,
    },
    Ptrace {
        pid: u32,
        tgid: u32,
        tracer_pid: u32,
        tracer_tgid: u32,
    },
    Comm {
        pid: u32,
        tgid: u32,
        comm: [u8; 16],
    },
    Coredump {
        pid: u32,
        tgid: u32,
    },
    Unknown {
        what: u32,
        raw_data: Vec<u8>,
    },
}

A parsed process event from the Linux Proc Connector.

Each variant corresponds to a PROC_EVENT_* constant from <linux/cn_proc.h>, with all relevant fields extracted into named fields.

The Unknown variant provides forward compatibility: if the kernel emits an event type this version of the library does not know about, it is returned as Unknown with the raw payload.

Example: pattern matching

use proc_connector::ProcEvent;

fn describe(event: &ProcEvent) -> String {
    match event {
        ProcEvent::Exec { pid, .. } => format!("process {pid} exec'd"),
        ProcEvent::Fork { child_pid, .. } => format!("forked child {child_pid}"),
        ProcEvent::Exit { pid, exit_code, .. } => {
            format!("process {pid} exited with code {exit_code}")
        }
        ProcEvent::Uid { pid, ruid, euid, .. } => {
            format!("process {pid} uid changed {ruid}->{euid}")
        }
        ProcEvent::Gid { pid, rgid, egid, .. } => {
            format!("process {pid} gid changed {rgid}->{egid}")
        }
        ProcEvent::Sid { pid, .. } => format!("process {pid} session changed"),
        ProcEvent::Ptrace { pid, tracer_pid, .. } => {
            format!("process {pid} traced by {tracer_pid}")
        }
        ProcEvent::Comm { pid, comm, .. } => {
            let name = String::from_utf8_lossy(comm);
            let name = name.trim_end_matches('\0');
            format!("process {pid} renamed to {name}")
        }
        ProcEvent::Coredump { pid, .. } => format!("process {pid} dumped core"),
        ProcEvent::Unknown { what, .. } => format!("unknown event 0x{what:08x}"),
    }
}

let exec = ProcEvent::Exec { pid: 42, tgid: 42 };
assert_eq!(describe(&exec), "process 42 exec'd");

let exit = ProcEvent::Exit { pid: 7, tgid: 7, exit_code: 0, exit_signal: 17 };
assert_eq!(describe(&exit), "process 7 exited with code 0");

Example: Display formatting

use proc_connector::ProcEvent;

let event = ProcEvent::Fork {
    parent_pid: 100,
    parent_tgid: 100,
    child_pid: 200,
    child_tgid: 200,
};
assert_eq!(event.to_string(), "FORK parent=(100,100) child=(200,200)");

Variants

Exec

A process called execve(2).

Fields

pid: u32

tgid: u32

Fork

A new process was created via fork/clone.

Fields

parent_pid: u32

parent_tgid: u32

child_pid: u32

child_tgid: u32

Exit

A process exited.

Fields

pid: u32

tgid: u32

exit_code: u32

exit_signal: u32

Uid

Real or effective UID changed.

Fields

pid: u32

tgid: u32

ruid: u32

euid: u32

Gid

Real or effective GID changed.

Fields

pid: u32

tgid: u32

rgid: u32

egid: u32

Sid

Session ID changed (setsid).

Fields

pid: u32

tgid: u32

Ptrace

ptrace attach or detach.

Fields

pid: u32

tgid: u32

tracer_pid: u32

tracer_tgid: u32

Comm

Process name (comm) changed (max 16 bytes, may include trailing NUL).

Fields

pid: u32

tgid: u32

comm: [u8; 16]

The new process name (up to 16 bytes, usually NUL-terminated).

Coredump

A core dump occurred.

Fields

pid: u32

tgid: u32

Unknown

An unknown event type (forward-compatibility).

Fields

what: u32

The raw what field value.

raw_data: Vec<u8>

Raw bytes of the event_data union (may be empty).

Trait Implementations

impl Clone for ProcEvent

fn clone(&self) -> ProcEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProcEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ProcEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for ProcEvent

fn eq(&self, other: &ProcEvent) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for ProcEvent

impl StructuralPartialEq for ProcEvent