func (m *Monitor) handleContainerEvent(msg events.Message) error {
	// Parse action
	var cmd string
	var args []string
	probeEventType := model.UnknownEventType
	switch msg.Action {
	case "create":
		probeEventType = model.ContainerCreatedEventType
	case "attach":
		probeEventType = model.ContainerAttachEventType
	case "start":
		probeEventType = model.ContainerRunningEventType
	case "destroy":
		probeEventType = model.ContainerDestroyedEventType
	case "die", "kill", "stop":
		probeEventType = model.ContainerExitedEventType
	default:
		// Look for exec_create or exec_start events
		splittedAction := strings.Split(msg.Action, ": ")
		switch splittedAction[0] {
		case "exec_start":
			probeEventType = model.ContainerExecEventType
			splittedCmd := strings.Split(splittedAction[1], " ")
			cmd = splittedCmd[0]
			args = splittedCmd[1:]
		default:
			// Return, we don't care about this event
			return nil
		}
	}
	// Create the container event
	var cdata *model.ContainerEvent
	var err error
	switch probeEventType {
	case model.ContainerDestroyedEventType, model.ContainerExitedEventType:
		cdata = m.createContainerDestroyedEvent(msg)
	default:
		cdata, err = m.createContainerEventFromContainerID(msg.ID)
		if err != nil {
			return err
		}
	}
	cdata.EventType = probeEventType
	if probeEventType == model.ContainerExecEventType {
		cdata.CommandPath = cmd
		cdata.CommandArgs = args
	}
	cdata.Timestamp = time.Unix(0, msg.TimeNano)
	return m.filterAndDispatchEvent(cdata)
}
// handleContainerEvent - Handle a container event
Handle a container event
// handleContainerEvent - Handle a container event
func (m *Monitor) handleContainerEvent(msg events.Message) error {
	var cmd string
	var args []string
	probeEventType := model.UnknownEventType
	switch msg.Action {
	case "create":
		probeEventType = model.ContainerCreatedEventType
	case "attach":
		probeEventType = model.ContainerAttachEventType
	case "start":
		probeEventType = model.ContainerRunningEventType
	case "destroy":
		probeEventType = model.ContainerDestroyedEventType
	case "die", "kill", "stop":
		probeEventType = model.ContainerExitedEventType
	default:
		splittedAction := strings.Split(msg.Action, ": ")
		switch splittedAction[0] {
		case "exec_start":
			probeEventType = model.ContainerExecEventType
			splittedCmd := strings.Split(splittedAction[1], " ")
			cmd = splittedCmd[0]
			args = splittedCmd[1:]
		default:
			return nil
		}
	}
	var cdata *model.ContainerEvent
	var err error
	switch probeEventType {
	case model.ContainerDestroyedEventType, model.ContainerExitedEventType:
		cdata = m.createContainerDestroyedEvent(msg)
	default:
		cdata, err = m.createContainerEventFromContainerID(msg.ID)
		if err != nil {
			return err
		}
	}
	cdata.EventType = probeEventType
	if probeEventType == model.ContainerExecEventType {
		cdata.CommandPath = cmd
		cdata.CommandArgs = args
	}
	cdata.Timestamp = time.Unix(0, msg.TimeNano)
	return m.filterAndDispatchEvent(cdata)
}
func ( m * Monitor ) handleContainerEvent ( msg events . Message ) error { var cmd string var args [ ] string probeEventType := model . UnknownEventType switch msg . Action { case " " : probeEventType = model . ContainerCreatedEventType case " " : probeEventType = model . ContainerAttachEventType case " " : probeEventType = model . ContainerRunningEventType case " " : probeEventType = model . ContainerDestroyedEventType case " " , " " , " " : probeEventType = model . ContainerExitedEventType default : splittedAction := strings . Split ( msg . Action , " " ) switch splittedAction [ 0 ] { case " " : probeEventType = model . ContainerExecEventType splittedCmd := strings . Split ( splittedAction [ 1 ] , " " ) cmd = splittedCmd [ 0 ] args = splittedCmd [ 1 : ] default : return nil } } var cdata * model . ContainerEvent var err error switch probeEventType { case model . ContainerDestroyedEventType , model . ContainerExitedEventType : cdata = m . createContainerDestroyedEvent ( msg ) default : cdata , err = m . createContainerEventFromContainerID ( msg . ID ) if err != nil { return err } } cdata . EventType = probeEventType if probeEventType == model . ContainerExecEventType { cdata . CommandPath = cmd cdata . CommandArgs = args } cdata . Timestamp = time . Unix ( 0 , msg . TimeNano ) return m . filterAndDispatchEvent ( cdata ) }
Handle a container event
Handle a container event
// Parse action // Look for exec_create or exec_start events // Return, we don't care about this event // Create the container event