Lines Matching refs:event

336     event = ctypes.cast(data, ctypes.POINTER(Event)).contents
339         if event.type == EventType.EVENT_MOUNT:
340             mounts[event.pid] = {
341                 'pid': event.pid,
342                 'tgid': event.tgid,
343                 'mnt_ns': event.union.enter.mnt_ns,
344                 'comm': event.union.enter.comm,
345                 'flags': event.union.enter.flags,
347         elif event.type == EventType.EVENT_MOUNT_SOURCE:
348             mounts[event.pid]['source'] = event.union.str
349         elif event.type == EventType.EVENT_MOUNT_TARGET:
350             mounts[event.pid]['target'] = event.union.str
351         elif event.type == EventType.EVENT_MOUNT_TYPE:
352             mounts[event.pid]['type'] = event.union.str
353         elif event.type == EventType.EVENT_MOUNT_DATA:
355             mounts[event.pid]['data'] = event.union.str
356         elif event.type == EventType.EVENT_UMOUNT:
357             umounts[event.pid] = {
358                 'pid': event.pid,
359                 'tgid': event.tgid,
360                 'mnt_ns': event.union.enter.mnt_ns,
361                 'comm': event.union.enter.comm,
362                 'flags': event.union.enter.flags,
364         elif event.type == EventType.EVENT_UMOUNT_TARGET:
365             umounts[event.pid]['target'] = event.union.str
366         elif (event.type == EventType.EVENT_MOUNT_RET or
367               event.type == EventType.EVENT_UMOUNT_RET):
368             if event.type == EventType.EVENT_MOUNT_RET:
369                 syscall = mounts.pop(event.pid)
377                     retval=decode_errno(event.union.retval))
379                 syscall = umounts.pop(event.pid)
383                     retval=decode_errno(event.union.retval))
407     b.attach_kprobe(event=mount_fnname, fn_name="syscall__mount")
408     b.attach_kretprobe(event=mount_fnname, fn_name="do_ret_sys_mount")
410     b.attach_kprobe(event=umount_fnname, fn_name="syscall__umount")
411     b.attach_kretprobe(event=umount_fnname, fn_name="do_ret_sys_umount")