Enum ObserverEventKind 

#[non_exhaustive]
pub enum ObserverEventKind {
    Started,
    Exited {
        exit_code: i32,
    },
    DescendantStarted,
    DescendantExited,
    FileOpen {
        path: PathBuf,
        flags: u32,
    },
    FileWrite {
        path: PathBuf,
        byte_count: u64,
    },
    FileClose {
        path: PathBuf,
    },
    FileUnlink {
        path: PathBuf,
    },
    FileRename {
        from: PathBuf,
        to: PathBuf,
    },
}

What happened to an observed process.

Marked #[non_exhaustive] per #431: Phase 3 will add variants for File, Network, and Process events. Out-of-crate matchers must include a wildcard arm to remain forward-compatible across minor releases.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Started

The child process was spawned. Carries no extra payload.

Exited

The child process exited. Carries the OS exit code (Unix signal exits are negative signal numbers, matching the rest of the crate).

Fields

exit_code: i32

Exit code of the child.

DescendantStarted

A descendant of the spawned process (i.e. a child of a child) was created. Emitted on the EventCategory::Process category by per-OS LaunchedProcessTree backends (#539). The descendant PID is carried by ObserverEvent::pid.

Unlike Started, this carries no exit code on the pair event because the no-admin descendant-lifecycle primitives (Windows Job Object IOCP, Linux pidfd reap, macOS EVFILT_PROC) surface PID-only notifications.

DescendantExited

A descendant process exited. Emitted on the EventCategory::Process category by per-OS LaunchedProcessTree backends (#539). The descendant PID is carried by ObserverEvent::pid; the exit code is not surfaced — see DescendantStarted for rationale.

FileOpen

A file was opened by the observed process. Emitted on the EventCategory::File category by the hook tier of the observer (the sidecar interposer in running-process-observer, tracked by #551). The pid in ObserverEvent::pid is the process that performed the call. flags is the platform-native open flags (POSIX O_* on Unix; Windows dwDesiredAccess | (dwShareMode << 16) encoded best-effort).

Fields

path: PathBuf

Filesystem path the consumer opened. On Linux/macOS this is the POSIX path passed to open(2) / openat(2); on Windows it’s the resolved Win32 path (DOS-form when available, NT path otherwise — matches the slice-4 #550 convention).

flags: u32

Platform-native open flags. Best-effort encoded.

FileWrite

A file was written to by the observed process. byte_count is the byte count returned by the syscall on success (may be shorter than the request on short writes). Emitted on the EventCategory::File category by the hook tier (#551).

Fields

path: PathBuf

Resolved path of the file the write targeted.

byte_count: u64

Number of bytes the syscall reported it actually wrote.

FileClose

A file descriptor / handle was closed. Emitted on the EventCategory::File category by the hook tier (#551). The path is resolved at hook-fire time from the fd / handle, so it matches the path the corresponding FileOpen event reported.

Fields

path: PathBuf

Resolved path of the file that was closed.

FileUnlink

A file was unlinked / deleted. Emitted on the EventCategory::File category by the hook tier (#551).

Fields

path: PathBuf

Path of the file that was unlinked.

FileRename

A file was renamed. Emitted on the EventCategory::File category by the hook tier (#551).

Fields

from: PathBuf

Path the file was renamed from.

to: PathBuf

Path the file was renamed to.

Implementations

impl ObserverEventKind

pub fn as_str(&self) -> &'static str

Return the stable lowercase event-kind name.

Trait Implementations

impl Clone for ObserverEventKind

fn clone(&self) -> ObserverEventKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ObserverEventKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ObserverEventKind

impl PartialEq for ObserverEventKind

fn eq(&self, other: &ObserverEventKind) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ObserverEventKind