Enum ProcEvent

pub enum ProcEvent {
    Ack {
        err: u32,
    },
    Fork {
        parent_pid: i32,
        parent_tgid: i32,
        child_pid: i32,
        child_tgid: i32,
    },
    Exec {
        process_pid: i32,
        process_tgid: i32,
    },
    Uid {
        process_pid: i32,
        process_tgid: i32,
        ruid: u32,
        euid: u32,
    },
    Gid {
        process_pid: i32,
        process_tgid: i32,
        rgid: u32,
        egid: u32,
    },
    Sid {
        process_pid: i32,
        process_tgid: i32,
    },
    Ptrace {
        process_pid: i32,
        process_tgid: i32,
        tracer_pid: i32,
        tracer_tgid: i32,
    },
    Comm {
        process_pid: i32,
        process_tgid: i32,
        comm: [u8; 16],
    },
    Coredump {
        process_pid: i32,
        process_tgid: i32,
        parent_pid: i32,
        parent_tgid: i32,
    },
    Exit {
        process_pid: i32,
        process_tgid: i32,
        exit_code: u32,
        exit_signal: u32,
        parent_pid: i32,
        parent_tgid: i32,
    },
}

Ergonomic enum for process event data.

Variants

Ack

Acknowledgement event, typically for PROC_EVENT_NONE.

Fields

err: u32

Error code (0 for success).

Fork

Fork event, triggered when a process forks.

Fields

parent_pid: i32

Parent process PID.

parent_tgid: i32

Parent process TGID (thread group ID).

child_pid: i32

Child process PID.

child_tgid: i32

Child process TGID.

Exec

Exec event, triggered when a process calls exec().

Fields

process_pid: i32

Process PID.

process_tgid: i32

Process TGID.

Uid

UID change event, triggered when a process changes its UID.

Fields

process_pid: i32

Process PID.

process_tgid: i32

Process TGID.

ruid: u32

Real UID.

euid: u32

Effective UID.

Gid

GID change event, triggered when a process changes its GID.

Fields

process_pid: i32

Process PID.

process_tgid: i32

Process TGID.

rgid: u32

Real GID.

egid: u32

Effective GID.

Sid

SID change event, triggered when a process changes its session ID.

Fields

process_pid: i32

Process PID.

process_tgid: i32

Process TGID.

Ptrace

Ptrace event, triggered when a process is traced.

Fields

process_pid: i32

Process PID.

process_tgid: i32

Process TGID.

tracer_pid: i32

Tracer process PID.

tracer_tgid: i32

Tracer process TGID.

Comm

Comm event, triggered when a process changes its command name.

Fields

process_pid: i32

Process PID.

process_tgid: i32

Process TGID.

comm: [u8; 16]

Command name (null-terminated, max 16 bytes).

Coredump

Coredump event, triggered when a process dumps core.

Fields

process_pid: i32

Process PID.

process_tgid: i32

Process TGID.

parent_pid: i32

Parent process PID.

parent_tgid: i32

Parent process TGID.

Exit

Exit event, triggered when a process exits.

Fields

process_pid: i32

Process PID.

process_tgid: i32

Process TGID.

exit_code: u32

Exit code.

exit_signal: u32

Exit signal.

parent_pid: i32

Parent process PID.

parent_tgid: i32

Parent process TGID.

Trait Implementations

impl Clone for ProcEvent

fn clone(&self) -> ProcEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProcEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Size for ProcEvent

fn unpadded_size(&self) -> usize

Size of the unpadded data structure. This will usually only be unaligned for variable length types like strings or byte buffers.

fn padded_size(&self) -> usize

Get the size of the payload and align it to the required netlink byte alignment.

impl Copy for ProcEvent