Beautify table print

aquasecurity · Jul 27, 2020 · 7c257ce · 7c257ce
1 parent 888c0e7
commit 7c257ce
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 12 deletions.
diff --git a/main.go b/main.go
@@ -75,7 +75,7 @@ func main() {
 				Name:    "output",
 				Aliases: []string{"o"},
 				Value:   "table",
-				Usage:   "output format: table/json/gob",
+				Usage:   "output format: table/table-verbose/json/gob",
 			},
 			&cli.StringSliceFlag{
 				Name:    "event",
@@ -84,9 +84,9 @@ func main() {
 				Usage:   "trace only the specified event or syscall. use this flag multiple times to choose multiple events",
 			},
 			&cli.StringSliceFlag{
-				Name:    "exclude-event",
-				Value:   nil,
-				Usage:   "exclude an event from being traced. use this flag multiple times to choose multiple events to exclude",
+				Name:  "exclude-event",
+				Value: nil,
+				Usage: "exclude an event from being traced. use this flag multiple times to choose multiple events to exclude",
 			},
 			&cli.BoolFlag{
 				Name:    "list",

diff --git a/tracee/printer.go b/tracee/printer.go
@@ -24,8 +24,15 @@ func newEventPrinter(kind string, out io.Writer, err io.Writer) eventPrinter {
 	switch kind {
 	case "table":
 		res = &tableEventPrinter{
-			out: out,
-			err: err,
+			out:     out,
+			err:     err,
+			verbose: false,
+		}
+	case "table-verbose":
+		res = &tableEventPrinter{
+			out:     out,
+			err:     err,
+			verbose: true,
 		}
 	case "json":
 		res = &jsonEventPrinter{
@@ -80,20 +87,29 @@ func newEvent(ctx context, args []interface{}) (Event, error) {
 }
 
 type tableEventPrinter struct {
-	tracee *Tracee
-	out    io.Writer
-	err    io.Writer
+	tracee  *Tracee
+	out     io.Writer
+	err     io.Writer
+	verbose bool
 }
 
 func (p tableEventPrinter) Init() {}
 
 func (p tableEventPrinter) Preamble() {
-	fmt.Fprintf(p.out, "%-14s %-16s %-12s %-12s %-6s %-16s %-16s %-6s %-6s %-6s %-12s %s", "TIME(s)", "UTS_NAME", "MNT_NS", "PID_NS", "UID", "EVENT", "COMM", "PID", "TID", "PPID", "RET", "ARGS")
+	if p.verbose {
+		fmt.Fprintf(p.out, "%-14s %-16s %-12s %-12s %-6s %-20s %-16s %-6s %-6s %-6s %-16s %s", "TIME(s)", "UTS_NAME", "MNT_NS", "PID_NS", "UID", "EVENT", "COMM", "PID", "TID", "PPID", "RET", "ARGS")
+	} else {
+		fmt.Fprintf(p.out, "%-14s %-16s %-6s %-20s %-16s %-6s %-6s %-6s %-16s %s", "TIME(s)", "UTS_NAME", "UID", "EVENT", "COMM", "PID", "TID", "PPID", "RET", "ARGS")
+	}
 	fmt.Fprintln(p.out)
 }
 
 func (p tableEventPrinter) Print(event Event) {
-	fmt.Fprintf(p.out, "%-14f %-16s %-12d %-12d %-6d %-16s %-16s %-6d %-6d %-6d %-12d", event.Timestamp, event.HostName, event.MountNS, event.PIDNS, event.UserID, event.EventName, event.ProcessName, event.ProcessID, event.ThreadID, event.ParentProcessID, event.ReturnValue)
+	if p.verbose {
+		fmt.Fprintf(p.out, "%-14f %-16s %-12d %-12d %-6d %-20s %-16s %-6d %-6d %-6d %-16d", event.Timestamp, event.HostName, event.MountNS, event.PIDNS, event.UserID, event.EventName, event.ProcessName, event.ProcessID, event.ThreadID, event.ParentProcessID, event.ReturnValue)
+	} else {
+		fmt.Fprintf(p.out, "%-14f %-16s %-6d %-20s %-16s %-6d %-6d %-6d %-16d", event.Timestamp, event.HostName, event.UserID, event.EventName, event.ProcessName, event.ProcessID, event.ThreadID, event.ParentProcessID, event.ReturnValue)
+	}
 	for _, value := range event.Args {
 		fmt.Fprintf(p.out, "%v ", value)
 	}

diff --git a/tracee/tracee.go b/tracee/tracee.go
@@ -43,7 +43,7 @@ func (tc TraceeConfig) Validate() error {
 	if tc.EventsToTrace == nil {
 		return fmt.Errorf("eventsToTrace is nil")
 	}
-	if tc.OutputFormat != "table" && tc.OutputFormat != "json" && tc.OutputFormat != "gob" {
+	if tc.OutputFormat != "table" && tc.OutputFormat != "table-verbose" && tc.OutputFormat != "json" && tc.OutputFormat != "gob" {
 		return fmt.Errorf("unrecognized output format: %s", tc.OutputFormat)
 	}
 	for _, e := range tc.EventsToTrace {