pub enum ProcEvent {
Exec {
cpu: u32,
pid: u32,
tgid: u32,
timestamp_ns: u64,
},
Fork {
cpu: u32,
parent_pid: u32,
parent_tgid: u32,
child_pid: u32,
child_tgid: u32,
timestamp_ns: u64,
},
Exit {
cpu: u32,
pid: u32,
tgid: u32,
exit_code: u32,
exit_signal: u32,
parent_pid: u32,
parent_tgid: u32,
timestamp_ns: u64,
},
Uid {
cpu: u32,
pid: u32,
tgid: u32,
ruid: u32,
euid: u32,
timestamp_ns: u64,
},
Gid {
cpu: u32,
pid: u32,
tgid: u32,
rgid: u32,
egid: u32,
timestamp_ns: u64,
},
Sid {
cpu: u32,
pid: u32,
tgid: u32,
timestamp_ns: u64,
},
Ptrace {
cpu: u32,
pid: u32,
tgid: u32,
tracer_pid: u32,
tracer_tgid: u32,
timestamp_ns: u64,
},
Comm {
cpu: u32,
pid: u32,
tgid: u32,
comm: [u8; 16],
timestamp_ns: u64,
},
Coredump {
cpu: u32,
pid: u32,
tgid: u32,
parent_pid: u32,
parent_tgid: u32,
timestamp_ns: u64,
},
Unknown {
what: u32,
raw_data: Vec<u8>,
},
}Expand description
A parsed process event from the Linux Proc Connector.
Each variant corresponds to a PROC_EVENT_* constant from
<linux/cn_proc.h>, with all relevant fields extracted into
named fields.
The Unknown variant provides forward compatibility: if the kernel
emits an event type this version of the library does not know about,
it is returned as Unknown with the raw payload.
§Example: pattern matching
use proc_connector::ProcEvent;
fn describe(event: &ProcEvent) -> String {
match event {
ProcEvent::Exec { pid, .. } => format!("process {pid} exec'd"),
ProcEvent::Fork { child_pid, .. } => format!("forked child {child_pid}"),
ProcEvent::Exit { pid, exit_code, .. } => {
format!("process {pid} exited with code {exit_code}")
}
ProcEvent::Uid { pid, ruid, euid, .. } => {
format!("process {pid} uid changed {ruid}->{euid}")
}
ProcEvent::Gid { pid, rgid, egid, .. } => {
format!("process {pid} gid changed {rgid}->{egid}")
}
ProcEvent::Sid { pid, .. } => format!("process {pid} session changed"),
ProcEvent::Ptrace { pid, tracer_pid, .. } => {
format!("process {pid} traced by {tracer_pid}")
}
ProcEvent::Comm { pid, comm, .. } => {
let name = String::from_utf8_lossy(comm);
let name = name.trim_end_matches('\0');
format!("process {pid} renamed to {name}")
}
ProcEvent::Coredump { pid, .. } => format!("process {pid} dumped core"),
ProcEvent::Unknown { what, .. } => format!("unknown event 0x{what:08x}"),
}
}
let exec = ProcEvent::Exec { cpu: 0, pid: 42, tgid: 42, timestamp_ns: 0 };
assert_eq!(describe(&exec), "process 42 exec'd");
let exit = ProcEvent::Exit { cpu: 0, pid: 7, tgid: 7, exit_code: 0, exit_signal: 17,
parent_pid: 1, parent_tgid: 1, timestamp_ns: 0 };
assert_eq!(describe(&exit), "process 7 exited with code 0");§Example: Display formatting
use proc_connector::ProcEvent;
let event = ProcEvent::Fork {
cpu: 0,
parent_pid: 100,
parent_tgid: 100,
child_pid: 200,
child_tgid: 200,
timestamp_ns: 0,
};
assert_eq!(event.to_string(), "FORK parent=(100,100) child=(200,200) ts=0");Variants§
Exec
A process called execve(2).
Fields
Fork
A new process was created via fork/clone.
Fields
Exit
A process exited.
Fields
Uid
Real or effective UID changed.
Fields
Gid
Real or effective GID changed.
Fields
Sid
Session ID changed (setsid).
Fields
Ptrace
ptrace attach or detach.
Fields
Comm
Process name (comm) changed (max 16 bytes, may include trailing NUL).
Fields
Coredump
A core dump occurred.
Fields
Unknown
An unknown event type (forward-compatibility).
Implementations§
Source§impl ProcEvent
impl ProcEvent
Sourcepub fn exit_status(&self) -> Option<i32>
pub fn exit_status(&self) -> Option<i32>
Extract the exit status from an Exit event’s exit_code field.
Returns the value that would be returned by WEXITSTATUS(exit_code),
i.e. the low 8 bits of the exit code. Returns None if the process
was terminated by a signal.
§Example
use proc_connector::ProcEvent;
let e = ProcEvent::Exit { cpu: 0, pid:1, tgid:1, exit_code: (1 << 8), exit_signal:0,
parent_pid:0, parent_tgid:0, timestamp_ns:0 };
assert_eq!(e.exit_status(), Some(1));Sourcepub fn terminating_signal(&self) -> Option<i32>
pub fn terminating_signal(&self) -> Option<i32>
Extract the terminating signal from an Exit event’s exit_code field.
Returns the signal number that caused the process to terminate,
i.e. WTERMSIG(exit_code). Returns None if the process exited
normally (not by signal).