Enum ProcEvent 

pub enum ProcEvent {
    Fork {
        child_pid: u32,
        parent_pid: u32,
        timestamp_ns: u64,
    },
    Exec {
        pid: u32,
        timestamp_ns: u64,
    },
    Exit {
        pid: u32,
    },
}

A process lifecycle event. Decoupled from any specific event source (proc-connector, audit, etc.) so users can adapt their own events.

Variants

Fork

A new process was created. parent_pid is the parent.

Fields

child_pid: u32

parent_pid: u32

timestamp_ns: u64

Exec

A process executed a new program. Its cmd/user may have changed.

Fields

pid: u32

timestamp_ns: u64

Exit

A process exited. The node is preserved for historical chain lookups.

Fields

pid: u32

Trait Implementations

impl Clone for ProcEvent

fn clone(&self) -> ProcEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProcEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.