Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: new write_and_close event #101

Merged
merged 4 commits into from
Sep 20, 2024
Merged

feat: new write_and_close event #101

merged 4 commits into from
Sep 20, 2024

Conversation

qjerome
Copy link
Member

@qjerome qjerome commented Sep 16, 2024

This PR contains the changes needed to have a new event write_and_close

This event would be generated when a file gets closed after being written.
Motivation:

  • write event is generated only when the file is first written
  • write event is generated only once per task so if the file gets written once again (by the same task) I'll not be shown again
  • such an event is a great trigger for file scanning as we are sure the file got closed (which is not the case of write event)

This PR also contains some little refactoring:

  • renamed userland structures encoding file events
  • bpf file tracking

@qjerome qjerome merged commit 3e29b6f into main Sep 20, 2024
1 check passed
@qjerome qjerome deleted the feat-close-file-mod branch September 20, 2024 08:50
@qjerome qjerome mentioned this pull request Oct 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant