Documentation
¶
Overview ¶
Package capture defines the pluggable capture-source interface that every observation enters the pipeline through, plus the startup probe that decides which sources can actually run here.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Probe ¶
type Probe struct {
Sources []types.Capabilities `json:"sources"`
// Active is the mode actually running: "deputy", "patrol", "offline" or
// "none".
Active string `json:"active"`
// Stored describes what a record contains when nothing is capturing, so a
// database being read offline still renders the views its data supports.
Stored *types.Capabilities `json:"stored,omitempty"`
}
Probe is the result of asking every known source what it can do here.
func (Probe) Effective ¶
func (p Probe) Effective() types.Capabilities
Effective collapses the probe into what the application as a whole can observe, which is the union over the sources that are actually available.
type Source ¶
type Source interface {
Name() string
Capabilities() types.Capabilities
Start(ctx context.Context, out chan<- types.RawEvent) error
Stop() error
}
Source produces raw observations. Implementations must never block the caller: Start returns as soon as capture is running, and everything after that arrives on the out channel.
A Source that cannot run (no privilege, unsupported OS) is not an error. It reports Available=false from Capabilities and explains itself via Hint, and the app carries on with whatever else it has. Capture privilege must never hard-fail the application.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package deputy implements Deputy Mode: watching this machine's own connections by reading the OS socket tables, with the owning process attached.
|
Package deputy implements Deputy Mode: watching this machine's own connections by reading the OS socket tables, with the owning process attached. |
|
Package patrol implements Patrol Mode: watching the whole network by passively capturing packets, rather than only this machine's own sockets.
|
Package patrol implements Patrol Mode: watching the whole network by passively capturing packets, rather than only this machine's own sockets. |