Enum ProcEvent

Source

pub enum ProcEvent {
    Exec {
        pid: u32,
        tgid: u32,
        timestamp_ns: u64,
    },
    Fork {
        parent_pid: u32,
        parent_tgid: u32,
        child_pid: u32,
        child_tgid: u32,
        timestamp_ns: u64,
    },
    Exit {
        pid: u32,
        tgid: u32,
        exit_code: u32,
        exit_signal: u32,
        timestamp_ns: u64,
    },
    Uid {
        pid: u32,
        tgid: u32,
        ruid: u32,
        euid: u32,
        timestamp_ns: u64,
    },
    Gid {
        pid: u32,
        tgid: u32,
        rgid: u32,
        egid: u32,
        timestamp_ns: u64,
    },
    Sid {
        pid: u32,
        tgid: u32,
        timestamp_ns: u64,
    },
    Ptrace {
        pid: u32,
        tgid: u32,
        tracer_pid: u32,
        tracer_tgid: u32,
        timestamp_ns: u64,
    },
    Comm {
        pid: u32,
        tgid: u32,
        comm: [u8; 16],
        timestamp_ns: u64,
    },
    Coredump {
        pid: u32,
        tgid: u32,
        timestamp_ns: u64,
    },
    Unknown {
        what: u32,
        raw_data: Vec<u8>,
    },
}

Expand description

A parsed process event from the Linux Proc Connector.

Each variant corresponds to a PROC_EVENT_* constant from <linux/cn_proc.h>, with all relevant fields extracted into named fields.

The Unknown variant provides forward compatibility: if the kernel emits an event type this version of the library does not know about, it is returned as Unknown with the raw payload.

§Example: pattern matching

use proc_connector::ProcEvent;

fn describe(event: &ProcEvent) -> String {
    match event {
        ProcEvent::Exec { pid, .. } => format!("process {pid} exec'd"),
        ProcEvent::Fork { child_pid, .. } => format!("forked child {child_pid}"),
        ProcEvent::Exit { pid, exit_code, .. } => {
            format!("process {pid} exited with code {exit_code}")
        }
        ProcEvent::Uid { pid, ruid, euid, .. } => {
            format!("process {pid} uid changed {ruid}->{euid}")
        }
        ProcEvent::Gid { pid, rgid, egid, .. } => {
            format!("process {pid} gid changed {rgid}->{egid}")
        }
        ProcEvent::Sid { pid, .. } => format!("process {pid} session changed"),
        ProcEvent::Ptrace { pid, tracer_pid, .. } => {
            format!("process {pid} traced by {tracer_pid}")
        }
        ProcEvent::Comm { pid, comm, .. } => {
            let name = String::from_utf8_lossy(comm);
            let name = name.trim_end_matches('\0');
            format!("process {pid} renamed to {name}")
        }
        ProcEvent::Coredump { pid, .. } => format!("process {pid} dumped core"),
        ProcEvent::Unknown { what, .. } => format!("unknown event 0x{what:08x}"),
    }
}

let exec = ProcEvent::Exec { pid: 42, tgid: 42, timestamp_ns: 0 };
assert_eq!(describe(&exec), "process 42 exec'd");

let exit = ProcEvent::Exit { pid: 7, tgid: 7, exit_code: 0, exit_signal: 17, timestamp_ns: 0 };
assert_eq!(describe(&exit), "process 7 exited with code 0");

§Example: Display formatting

use proc_connector::ProcEvent;

let event = ProcEvent::Fork {
    parent_pid: 100,
    parent_tgid: 100,
    child_pid: 200,
    child_tgid: 200,
    timestamp_ns: 0,
};
assert_eq!(event.to_string(), "FORK parent=(100,100) child=(200,200) ts=0");