addWatch - Updates the eBPF hashmaps to look for the provided paths

get_inode_ino - Returns the inode number of an inode structure

Certain types of events can be "ignored" and not sent over the Events channel. Such as events marked ignore by the kernel, or MODIFY events against fi

init - Initializes the NetworkSecurityProbe

listen - Listen for new events from the kernel

loadEBPFProgram - Loads the compiled eBPF programs

load_follow_mode - Loads the follow mode

load_inode_filtering_mode - Loads the inode filtering mode

load_recursive_mode - Loads the recursive mode

newEvent returns an platform-independent Event based on an inotify mask.

Create a new inotify poller. This creates an inotify handler, and an epoll handler.

pollStop - Stop a perf map listener

readEvents reads from the inotify file descriptor, converts the received events into Event objects and sends them via the Events channel

removeUnusedMaps - Removes unused maps in the collectionSpec so that we use less kernel memory

resolvePaths - Resolves the paths of the event according to the configured method

resolve_fragments - Resolves the paths of an event using the multiple fragments method. This method creates an entry in a hashmap for each parent of t

resolve_perf_buffer - Resolves the paths of an event using the perf buffer method. This method resolves the paths directly in the buffer of the event

resolve_single_fragment - Resolves the paths of an event using the single fragment method. This method resolves the each path in one entry of the sing

sanitizeOptions - Sanitizes the provided options

setup - runs the setup steps to start fsprobe

startMonitors - Loads and attaches the eBPF program in the kernel

trace_link - Traces a file system link event. @ctx: registers context @old_dentry: pointer to the dentry structure of the source file @new_dir: pointe

trace_link_ret - Traces the return of a file system link event. @ctx: registers context

trace_mkdir - Traces a file system mkdir event. @ctx: registers context @dir: pointer to the inode of the containing directory @dentry: pointer to the

trace_mkdir_ret - Traces the return of a file system mkdir event. @ctx: registers context

trace_modify - Traces a file modification event. @ctx: registers context @dentry: pointer to the dentry of the file

trace_modify_ret - Traces the return of a file modification event. @ctx: registers context

trace_open - Traces a file system open event. @ctx: registers context @path: pointer to the file path structure

trace_open_ret - Traces the return of a file system open event. @ctx: registers context

trace_rename - Traces a file system rename event. @ctx: registers context @old_dentry: pointer to the dentry structure of the source file @new_dir: po

trace_rename_ret - Traces the return of a file system rename event. @ctx: registers context

trace_rmdir - Traces a file system rmdir event. @ctx: registers context @dir: pointer to the directory that contains the directory to delete @dentry:

trace_rmdir_ret - Traces the return of a file system rmdir event. @ctx: registers context

trace_security_inode_setattr - Traces a file system setattr event. @ctx: registers context @dentry: pointer to the dentry of the file @attr: pointer t

trace_setattr_ret - Traces the return of a file system setattr event. @ctx: registers context

trace_unlink - Traces a file system unlink event. @ctx: registers context @dir: pointer to the inode structure of the directory containing the file to

trace_unlink_ret - Traces the return of a file system unlink event. @ctx: registers context

wait - Waits until an interrupt or kill signal is sent

Wait using epoll. Returns true if something is ready to be read, false if there is not.

Close the write end of the poller.

write_inode_ino - Writes the inode number of an inode structure

write_inode_short_ino - Writes the inode number of an inode structure

AddCacheEntry - Adds a new entry in the user space cache

AddCacheEntry - Adds a new entry in the user space cache

AddCacheEntry - Adds a new entry in the LRU cache

AssetNames returns the names of the assets. nolint: deadcode

Bytes - No copy string to bytes conversion

GetBootTime - Returns the boot time of fsprobe

GetCgroupFromPid - Returns the cgroup of a process

GetCollection - Returns the eBPF collection of fsprobe

GetCommFromPid - Returns the comm of a process

GetHostByteOrder - Returns the host byte order

GetHostPidns - Returns the host pidns of fsprobe

GetMntnsFromPid - Returns the mount namespace of a process

GetNetnsFromPid - Returns the network namespace of a process

GetOptions - Returns the config of fsprobe

GetPpid is a fallback to read the parent PID from /proc. Some kernel versions, like 4.13.0 return 0 getting the parent PID from the current task, so w

GetString - Returns the path as a string

GetUsernsFromPid - Returns the user namespace of a process

GetWaitGroup - Returns the wait group of fsprobe

HandleFSEvent - Handles a file system event

Init - Initializes the monitor

Init - Initializes perfmap

InterfaceToBytes - Tranforms an interface into a C bytes array

LostFSEvent - Handles a LostEvent

MustAsset is like Asset but panics when Asset would return an error. It simplifies safe initialization of global variables. nolint: deadcode

Read - Reads the provided data into the buffer

Read - Reads the provided data into the buffer

Remove stops watching the named file or directory (non-recursively).

RemoveEntry - Removes an entry from the cache

RemoveEntry - Removes an entry from the cache

RemoveEntry - Removes an entry from the cache

RemoveInode - Removes a pathname from the kernel cache using the provided mount id and inode

RemoveInode - Removes a pathname from the kernel cache using the provided mount id and inode

RemoveInode - Removes a pathname from the kernel cache using the provided mount id and inode

RemoveRecursive stops watching the named directory and all sub-directories.

ResolveInode - Resolves a pathname from the provided mount id and inode

ResolveInode - Does nothing

ResolveInode - Does nothing