kcap

type Config ¶

type Config struct {
	FlushPeriod time.Duration
}

Config stores options that influences the behaviour of the kernel capture reader/writer.

type Reader ¶

type Reader interface {
	// Read returns two channels. The event channel is poplated with event instances pulled from the kcap. If
	// any error occurs during kcap processing, it is pushed to the error channel.
	Read(ctx context.Context) (chan *kevent.Kevent, chan error)
	// Close shutdowns the reader gracefully.
	Close() error
	// RecoverSnapshotters recovers the statate of the snapshotters from the kcap.
	RecoverSnapshotters() (handle.Snapshotter, ps.Snapshotter, error)
	// SetFilter sets the filter that's is applied to each event coming out of the kcap.
	SetFilter(f filter.Filter)
}

Reader offers the mechanism for recovering the state of the kcapture and replaying all captured events.

func NewReader(filename string, config *config.Config) (Reader, error)

type Writer ¶

type Writer interface {
	// Write accepts two channels. The event channel receives events pushed by the kstream consumer. When the event
	// is peeked from the channel, it is serialized and written to the underlying byte buffer.
	Write(chan *kevent.Kevent, chan error) chan error
	// Close disposes all resources allocated by the writer.
	Close() error
}

Writer is the minimal interface that all kcap writers need to satisfy. The kcap file format has the layout as depicted in the following diagram:

 +-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-++-+-+-+
 | Magic Number  | Major | Minor | Flags |
	|----------------------------------------
 | Handle Section |       Handles        |
 -----------------------------------------
 | Kevt Section | Kevt ..................|
	| ......................................|
	| ......................................|
	| ......................................|
 | ........ Kevt Section n  Kevt n  EOF  |
 +-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-++-+-+-+

func NewWriter(filename string, psnap ps.Snapshotter, hsnap handle.Snapshotter) (Writer, error)