in pkg/accesslog/common/connection.go [526:568]
func (c *ConnectionManager) RecheckAllProcesses(processes map[int32][]api.ProcessInterface) {
shouldMonitoringProcesses := make(map[int32][]api.ProcessInterface)
for pid, p := range processes {
monitorProcesses := c.shouldMonitorProcesses(p)
if len(monitorProcesses) == 0 {
continue
}
shouldMonitoringProcesses[pid] = monitorProcesses
}
// checking the monitoring process
c.monitoringProcesses = shouldMonitoringProcesses
// for-each the existing monitored map, it should not be monitored, then remote it
iterate := c.processMonitorMap.Iterate()
processInBPF := make(map[int32]bool)
var pid uint32
var monitor uint32
for iterate.Next(&pid, &monitor) {
processInBPF[int32(pid)] = true
}
c.monitoringProcessLock.RLock()
defer c.monitoringProcessLock.RUnlock()
// make sure BPF and user space are consistent
for pid := range processInBPF {
if _, ok := c.monitoringProcesses[pid]; !ok {
c.updateMonitorStatusForProcess(pid, false)
for _, l := range c.processListeners {
l.OnProcessRemoved(pid)
}
}
}
for pid := range c.monitoringProcesses {
if _, ok := processInBPF[pid]; !ok {
c.updateMonitorStatusForProcess(pid, true)
for _, l := range c.processListeners {
l.OnNewProcessMonitoring(pid)
}
}
}
// update all IP addresses
c.rebuildLocalIPWithPID()
}