diff --git a/forensics/mxvmem b/forensics/mxvmem index 27e2143..e2cf070 100755 --- a/forensics/mxvmem +++ b/forensics/mxvmem @@ -229,6 +229,7 @@ class ProcFsHandler(): self.uptime = -1 self.memtotal = -1 self.age_threshold = age_thresh * 60*60*24 # days + self.supr_sys = False # used to suppress system accounts def set_uptime(self, t): self.uptime = t @@ -236,6 +237,9 @@ class ProcFsHandler(): def set_memtotal(self, m): self.memtotal = m + def suppress_system_acc(self): + self.supr_sys = True + def report_append(self, s): self.report.append(s) @@ -252,6 +256,7 @@ class ProcFsHandler(): vmdata = 0 state = '' uid = self.store[p]['uid'] + if self.supr_sys and (uid < 100 or uid >= 65533): continue if not uid in self.usermap: try: @@ -422,6 +427,8 @@ def handle_args(): help='location of forensics logs (/var/log)') ap.add_argument('-m', dest='memthresh', metavar='percent' , help='threshold for memory usage report (10%%)', default=10.0, type=float) + ap.add_argument('-o', dest='no_sysacc', + help='omit system accounts from being reported', action='store_true', default=False) ap.add_argument('-q', dest='query', metavar='query' , help='report memory usage for given categories (eg. \'SD\')', default='') ap.add_argument('-s', dest='summary', @@ -480,6 +487,7 @@ if __name__ == '__main__': pmc = ProcMemClassifier() whs = ProcFsHandler(pmc, float(args.durationthresh)) + if args.no_sysacc: whs.suppress_system_acc() psp = ProcStreamParser(whs) for line in proc: