Skip to content

Conversation

@Molter73
Copy link
Collaborator

Description

This is currently a PoC for adding file metadata to our events.

Checklist

  • Investigated and inspected CI test results
  • Updated documentation accordingly

Automated testing

  • Added unit tests
  • Added integration tests
  • Added regression tests

If any of these don't apply, please comment below.

Testing Performed

TODO(replace-me)
Use this space to explain how you tested your PR, or, if you didn't test it, why you did not do so. (Valid reasons include "CI is sufficient" or "No testable changes")
In addition to reviewing your code, reviewers must also review your testing instructions, and make sure they are sufficient.

For more details, ref the Confluence page about this section.

Copy link
Contributor

@Stringy Stringy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! how would this look in the protos?

@Molter73
Copy link
Collaborator Author

I guess we could do something like this:

message FileMetadata {
  uint32 mode;
  uint32 uid;
  uint32 gid;
  int64 size;
}

message FileActivity {
  google.protobuf.Timestamp timestamp = 1;
  ProcessSignal process = 2;
  oneof file {
    FileCreation creation = 3;
    FileUnlink unlink = 4;
    FileRename rename = 5;
    FilePermissionChange permission = 6;
    FileOwnershipChange ownership = 7;
    FileOpen open = 8;
    FileWrite write = 9;
  }
  FileMetadata metadata = 10;
}

We would need to make it clear the metadata field holds the values prior to the change being executed, so if a write occurs and the size of the file changes we will report the original file size, for permission changes the metadata will hold the value before the change goes through, etc...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants