diff --git a/aha/aha-eye.py b/aha/aha-eye.py index 21c03e9b4fa..ef7dac840ef 100644 --- a/aha/aha-eye.py +++ b/aha/aha-eye.py @@ -32,15 +32,21 @@ def extract_object(obj): #Annotation info is only available in sys_execve messages print "annotate process ",pid ptress.annotateProcessList(obj) + #But need to record ppid for pid reusage .grrr + if (tp == 2): + if (ptress.searchTree(pid,ppid)): + ptress.annotateProcessList(obj) # Thread exited if (tp == 3): if ptress.does_user_disconnects(pid): #User disconnected generate a report, to avoid that other #information is droped - print "List export is triggered" + print "List export is triggered for root ",pid ptress.exportUserListTxt('userlist.txt') ptress.silent_remove_pid(pid) - + #Cleanup annotated list + print "Clean annotated list" + ptress.clean_aplist(pid) except ValueError,e: print "Failed to parse ",obj except KeyError,e: diff --git a/aha/ahalib.py b/aha/ahalib.py index 07bb41af87a..3933a064381 100644 --- a/aha/ahalib.py +++ b/aha/ahalib.py @@ -134,6 +134,8 @@ class ProcessTrees: if self.aplist.has_key(pid) == False: #Got a new process, so create a new dictionary for meta data self.aplist[pid] = dict() + #Store the parent + self.aplist[pid]['parent'] = ppid #Does the message has a file name ? if msg.has_key('file'): self.aplist[pid]['file'] = msg['file'][0] @@ -300,10 +302,37 @@ class ProcessTrees: ret.append(c) return ret + #Recursively get the children of a process. This time from the annotated + #list. + #Internal function + def __get_aplist_children(self,pid): + #Establish a list of children for a process + children = [] + #FIXME not efficient; Go through all the processes + for p in self.aplist.keys(): + if self.aplist[p]['parent'] == pid: + children.append(p) + #Record them in a global list too + self.children[p]=1 + if len(children) == 0: + return + #Go through the children list and do a recursion + for p in children: + self.__get_aplist_children(p) + + def get__aplist_children(self,pid): + #Empty the list; do not want duplicates + self.children = dict() + self.__get_aplist_children(pid) + return self.children.keys() + #Pid is the root; remove this pid and all chidren def clean_aplist(self,pid): - #aplist needs to be cleaned up else process recycling is worse - pass + children = self.get__aplist_children(pid) + print "Removal candidates" + for pid in children: + self.aplist.pop(pid) + class TestProcessTree(unittest.TestCase): def testSearchRegular0(self): x = ProcessTrees()