user/event: decoding ktime

user/event/event_gnutls.go

@@ -54,6 +54,12 @@ func (ge *GnutlsDataEvent) Decode(payload []byte) (err error) {
 	if err = binary.Read(buf, binary.LittleEndian, &ge.Comm); err != nil {
 		return
 	}
+
+	decodedKtime, err := DecodeKtime(int64(ge.Timestamp), true)
+	if err == nil {
+		ge.Timestamp = uint64(decodedKtime.Unix())
+	}
+
 	return nil
 }
 

user/event/event_mysqld.go

@@ -97,6 +97,12 @@ func (me *MysqldEvent) Decode(payload []byte) (err error) {
 	if err = binary.Read(buf, binary.LittleEndian, &me.Retval); err != nil {
 		return
 	}
+
+	decodedKtime, err := DecodeKtime(int64(me.Timestamp), true)
+	if err == nil {
+		me.Timestamp = uint64(decodedKtime.Unix())
+	}
+
 	return nil
 }
 

user/event/event_nspr.go

@@ -55,6 +55,10 @@ func (ne *NsprDataEvent) Decode(payload []byte) (err error) {
 	if err = binary.Read(buf, binary.LittleEndian, &ne.Comm); err != nil {
 		return
 	}
+	decodedKtime, err := DecodeKtime(int64(ne.Timestamp), true)
+	if err == nil {
+		ne.Timestamp = uint64(decodedKtime.Unix())
+	}
 	return nil
 }
 

user/event/event_openssl.go

@@ -112,6 +112,10 @@ func (se *SSLDataEvent) Decode(payload []byte) (err error) {
 		return
 	}
 
+	decodedKtime, err := DecodeKtime(int64(se.Timestamp), true)
+	if err == nil {
+		se.Timestamp = uint64(decodedKtime.Unix())
+	}
 	return nil
 }
 

user/event/event_postgres.go

@@ -55,6 +55,10 @@ func (pe *PostgresEvent) Decode(payload []byte) (err error) {
 	if err = binary.Read(buf, binary.LittleEndian, &pe.Comm); err != nil {
 		return
 	}
+	decodedKtime, err := DecodeKtime(int64(pe.Timestamp), true)
+	if err == nil {
+		pe.Timestamp = uint64(decodedKtime.Unix())
+	}
 	return nil
 }
 

user/event/misc.go

@@ -17,6 +17,9 @@ package event
 import (
 	"bytes"
 	"fmt"
+	"time"
+
+	"golang.org/x/sys/unix"
 )
 
 // 格式化输出相关
@@ -88,3 +91,19 @@ func CToGoString(c []byte) string {
 	}
 	return string(c[:n+1])
 }
+
+func DecodeKtime(ktime int64, monotonic bool) (time.Time, error) {
+	var clk int32
+	if monotonic {
+		clk = int32(unix.CLOCK_MONOTONIC)
+	} else {
+		clk = int32(unix.CLOCK_BOOTTIME)
+	}
+	currentTime := unix.Timespec{}
+	if err := unix.ClockGettime(clk, &currentTime); err != nil {
+		return time.Time{}, err
+	}
+	diff := ktime - currentTime.Nano()
+	t := time.Now().Add(time.Duration(diff))
+	return t, nil
+}