1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
/*
Copyright (C) 2021 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once
class sinsp;
class sinsp_evt;
/** @defgroup dump Dumping events to disk
* Classes to perform miscellaneous functionality
* @{
*/
/*!
\brief A support class to dump events to file in scap format.
*/
class SINSP_PUBLIC sinsp_dumper
{
public:
/*!
\brief Constructs the dumper.
\param inspector Pointer to the inspector object that will be the source
of the events to save.
*/
sinsp_dumper(sinsp* inspector);
/*!
\brief Constructs a dumper that saves to memory instead of disk.
Takes the address and the size of a preallocated memory buffer
where the data will go.
*/
sinsp_dumper(sinsp* inspector,
uint8_t* target_memory_buffer,
uint64_t target_memory_buffer_size);
~sinsp_dumper();
/*!
\brief Opens the dump file.
\param filename The name of the target file.
\param compress true to save the trace file in a compressed format.
\param threads_from_sinsp If, true the thread and FD tables in the file
will be created from the current sinsp's tables instead of reusing the scap
ones.
\note There's no close() because the file is closed when the dumper is
destroyed.
*/
void open(const string& filename,
bool compress,
bool threads_from_sinsp=false);
void fdopen(int fd,
bool compress,
bool threads_from_sinsp=false);
/*!
\brief Closes the dump file.
*/
void close();
/*!
\brief Return whether or not the underling scap file has been
opened.
*/
bool is_open();
/*!
\brief Return the number of events dumped so far.
*/
bool written_events();
/*!
\brief Return the current size of a trace file.
\return The current size of the dump file.
*/
uint64_t written_bytes();
/*!
\brief Return the starting position for the next write into
the file. (Under the covers, this uses gztell while
written_bytes uses gzoffset, which represent different values).
\return The starting position for the next write.
*/
uint64_t next_write_position();
/*!
\brief Flush all pending output into the file.
*/
void flush();
/*!
\brief Writes an event to the file.
\param evt Pointer to the event to dump.
*/
void dump(sinsp_evt* evt);
inline uint8_t* get_memory_dump_cur_buf()
{
return scap_get_memorydumper_curpos(m_dumper);
}
inline void set_inspector(sinsp *inspector)
{
m_inspector = inspector;
}
private:
sinsp* m_inspector;
scap_dumper_t* m_dumper;
uint8_t* m_target_memory_buffer;
uint64_t m_target_memory_buffer_size;
uint64_t m_nevts;
};
/*@}*/
|
