|
@@ -56,7 +56,9 @@ struct proc_event {
|
|
PROC_EVENT_PTRACE = 0x00000100,
|
|
PROC_EVENT_PTRACE = 0x00000100,
|
|
PROC_EVENT_COMM = 0x00000200,
|
|
PROC_EVENT_COMM = 0x00000200,
|
|
/* "next" should be 0x00000400 */
|
|
/* "next" should be 0x00000400 */
|
|
- /* "last" is the last process event: exit */
|
|
|
|
|
|
+ /* "last" is the last process event: exit,
|
|
|
|
+ * while "next to last" is coredumping event */
|
|
|
|
+ PROC_EVENT_COREDUMP = 0x40000000,
|
|
PROC_EVENT_EXIT = 0x80000000
|
|
PROC_EVENT_EXIT = 0x80000000
|
|
} what;
|
|
} what;
|
|
__u32 cpu;
|
|
__u32 cpu;
|
|
@@ -110,11 +112,17 @@ struct proc_event {
|
|
char comm[16];
|
|
char comm[16];
|
|
} comm;
|
|
} comm;
|
|
|
|
|
|
|
|
+ struct coredump_proc_event {
|
|
|
|
+ __kernel_pid_t process_pid;
|
|
|
|
+ __kernel_pid_t process_tgid;
|
|
|
|
+ } coredump;
|
|
|
|
+
|
|
struct exit_proc_event {
|
|
struct exit_proc_event {
|
|
__kernel_pid_t process_pid;
|
|
__kernel_pid_t process_pid;
|
|
__kernel_pid_t process_tgid;
|
|
__kernel_pid_t process_tgid;
|
|
__u32 exit_code, exit_signal;
|
|
__u32 exit_code, exit_signal;
|
|
} exit;
|
|
} exit;
|
|
|
|
+
|
|
} event_data;
|
|
} event_data;
|
|
};
|
|
};
|
|
|
|
|