void CollectionMonitor::run()

in CollectionMonitor.cpp [37:110]


void CollectionMonitor::run() {
    Logger::Info("CollectionMonitor started");

    if (_netlink.Open(nullptr) != 0) {
        Logger::Error("CollectionMonitor: Could not open NETLINK connect, exiting");
        return;
    }

    do {
        auto now = std::chrono::steady_clock::now();

        if (_pause_collector_check && now - _pause_time > std::chrono::seconds(3600)) {
            _pause_collector_check = false;
        }

        uint32_t audit_pid = 0;
        auto ret = NetlinkRetry([this,&audit_pid]() { return _netlink.AuditGetPid(audit_pid); });
        if (ret != 0) {
            // Treat NETLINK errors as unrecoverable.
            if (!IsStopping()) {
                Logger::Warn("CollectionMonitor: Failed to get audit pid from audit NETLINK: %s", std::strerror(-ret));
            }
            audit_pid = 0;
        }
        if (!PathExists("/proc/"+std::to_string(audit_pid))) {
            audit_pid = 0;
        }

        // Always get collector aliveness. This will ensure the child is reaped if it exits and won't be restarted.
        bool is_alive = is_collector_alive();

        if (!_pause_collector_check && !is_auditd_present() && !is_alive && audit_pid == 0) {
            start_collector();

            int netlink_errno = 0;
            while (!IsStopping() && audit_pid <= 0 && !_sleep(500) && std::chrono::steady_clock::now() - now < std::chrono::seconds(10)) {
                auto ret = NetlinkRetry([this,&audit_pid]() { return _netlink.AuditGetPid(audit_pid); });
                if (ret != 0) {
                    // Treat NETLINK errors as unrecoverable.
                    if (!IsStopping()) {
                        netlink_errno = -ret;
                    }
                    audit_pid = 0;
                } else {
                    netlink_errno = 0;
                    if (!PathExists("/proc/"+std::to_string(audit_pid))) {
                        audit_pid = 0;
                    }
                }
            }
            if (IsStopping()) {
                break;
            }
            if (netlink_errno != 0) {
                Logger::Warn("CollectionMonitor: Failed to get audit pid from audit NETLINK: %s", std::strerror(netlink_errno));
            } else {
                if (audit_pid == 0) {
                    if (check_child(false)) {
                        Logger::Warn("CollectionMonitor: Collector has not set itself as the audit pid after 10 seconds");
                    }
                }
            }
        }

        if (!IsStopping()) {
            if (audit_pid != _audit_pid || now - _last_audit_pid_report > std::chrono::seconds(3600)) {
                _last_audit_pid_report = now;
                _audit_pid = audit_pid;
                send_audit_pid_report(audit_pid);
            }
        }
    } while(!_sleep(10000));
    Logger::Info("CollectionMonitor stopping");
}