SI_FP_PROP(FP_SI_PI_SEQUENCE_NUMBER , SI_PI_PRIVATE_SEQUENCE_NUMBER , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , sequence_number) SI_FP_PROP(FP_SI_PI_EVENT_UID , SI_PI_EVENT_UID , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , event_uid) SI_FP_PROP(FP_SI_PI_THREAD_ID , SI_PI_THREAD_ID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , thread_id) SI_FP_PROP(FP_SI_PI_OTHER_THREAD_ID , SI_PI_PRIVATE_OTHER_THREAD_ID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , other_thread_id) SI_FP_PROP(FP_SI_PI_PROCESS_ID , SI_PI_PROCESS_ID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , process_id) SI_FP_PROP(FP_SI_PI_PROCESS_UID , SI_PI_PROCESS_UID , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , process_uid) SI_FP_PROP(FP_SI_PI_PARENT_PROCESS_ID , SI_PI_PARENT_PROCESS_ID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , parent_process_id) SI_FP_PROP(FP_SI_PI_PARENT_PROCESS_UID , SI_PI_PARENT_PROCESS_UID , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , parent_process_uid) SI_FP_PROP_SIZED(FP_SI_PI_OBJECT_NAME , SI_PI_OBJECT_NAME , FP_SI_VT_UTF8_STRING_TYPE, SiSizedString , object_name) SI_FP_PROP_SIZED(FP_SI_PI_TARGET_NAME , SI_PI_TARGET_NAME , FP_SI_VT_UTF8_STRING_TYPE, SiSizedString , target_name) SI_FP_PROP(FP_SI_PI_OBJECT_ID , SI_PI_OBJECT_ID , FP_SI_VT_OBJECT_ID_TYPE , SiObjectId , object_id) SI_FP_PROP(FP_SI_PI_TARGET_ID , SI_PI_TARGET_ID , FP_SI_VT_OBJECT_ID_TYPE , SiObjectId , target_id) SI_FP_PROP(FP_SI_PI_OBJECT_REGION , SI_PI_OBJECT_REGION , FP_SI_VT_REGION_TYPE , SiRegion , object_region) SI_FP_PROP(FP_SI_PI_FLAGS , SI_PI_FLAGS , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , flags) SI_FP_PROP_SIZED(FP_SI_PI_IMAGE_FILE_NAME , SI_PI_IMAGE_FILE_NAME , FP_SI_VT_UTF8_STRING_TYPE, SiSizedString , image_file_name) SI_FP_PROP_SIZED(FP_SI_PI_COMMAND_LINE , SI_PI_COMMAND_LINE , FP_SI_VT_UTF8_STRING_TYPE, SiSizedString , command_line) SI_FP_PROP(FP_SI_PI_PROCESS_FILE_NAME_IS_NOT_PATH , SI_PI_PROCESS_FILE_NAME_IS_NOT_PATH , FP_SI_VT_BOOLEAN_TYPE , bool , process_file_name_is_not_path) SI_FP_PROP(FP_SI_PI_TERMINATED_PROCESS , SI_PI_TERMINATED_PROCESS , FP_SI_VT_BOOLEAN_TYPE , bool , terminated_process) SI_FP_PROP(FP_SI_PI_ACCESS_MODE , SI_PI_ACCESS_MODE , FP_SI_VT_SIGNED32_TYPE , int32_t , access_mode) SI_FP_PROP(FP_SI_PI_FILE_POS , SI_PI_FILE_POS , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , file_pos) SI_FP_PROP(FP_SI_PI_PROTECTION , SI_PI_PROTECTION , FP_SI_VT_SIGNED32_TYPE , int32_t , protection) SI_FP_PROP(FP_SI_PI_CONTROL_COMMAND , SI_PI_CONTROL_COMMAND , FP_SI_VT_SIGNED32_TYPE , int32_t , control_command) SI_FP_PROP(FP_SI_PI_CONTROL_ARG , SI_PI_CONTROL_ARG , FP_SI_VT_SIGNED64_TYPE , int64_t , control_arg) SI_FP_PROP(FP_SI_PI_USER_ID , SI_PI_USER_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , user_id) SI_FP_PROP(FP_SI_PI_GROUP_ID , SI_PI_GROUP_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , group_id) SI_FP_PROP(FP_SI_PI_EVENT_TIMESTAMP , SI_PI_EVENT_TIMESTAMP , FP_SI_VT_UNSIGNED64_TYPE , SiTimeMicroseconds , event_timestamp) SI_FP_PROP(FP_SI_PI_PROCESS_START_TIMESTAMP , SI_PI_PROCESS_START_TIMESTAMP , FP_SI_VT_UNSIGNED64_TYPE , SiTimeMicroseconds , process_start_timestamp) SI_FP_PROP(FP_SI_PI_SYSTEM_TIME_OLD_TIMESTAMP , SI_PI_SYSTEM_TIME_OLD_TIMESTAMP , FP_SI_VT_UNSIGNED64_TYPE , SiTimeMicroseconds , system_time_old_timestamp) SI_FP_PROP(FP_SI_PI_SYSTEM_TIME_NEW_TIMESTAMP , SI_PI_SYSTEM_TIME_NEW_TIMESTAMP , FP_SI_VT_UNSIGNED64_TYPE , SiTimeMicroseconds , system_time_new_timestamp) SI_FP_PROP(FP_SI_PI_ARTIFICIAL_PROCESS_START_TIMESTAMP , SI_PI_ARTIFICIAL_PROCESS_START_TIMESTAMP , FP_SI_VT_UNSIGNED64_TYPE , SiTimeMicroseconds , artificial_process_start_timestamp) SI_FP_PROP(FP_SI_PI_PARENT_ARTIFICIAL_PROCESS_START_TIMESTAMP , SI_PI_PARENT_ARTIFICIAL_PROCESS_START_TIMESTAMP , FP_SI_VT_UNSIGNED64_TYPE , SiTimeMicroseconds , parent_artificial_process_start_timestamp) SI_FP_PROP(FP_SI_PI_PARENT_PROCESS_START_TIMESTAMP , SI_PI_PARENT_PROCESS_START_TIMESTAMP , FP_SI_VT_UNSIGNED64_TYPE , SiTimeMicroseconds , parent_process_start_timestamp) SI_FP_PROP(FP_SI_PI_EFFECTIVE_USER_ID , SI_PI_EFFECTIVE_USER_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , effective_user_id) SI_FP_PROP(FP_SI_PI_EFFECTIVE_GROUP_ID , SI_PI_EFFECTIVE_GROUP_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , effective_group_id) SI_FP_PROP(FP_SI_PI_FILE_MODE , SI_PI_PRIVATE_FILE_MODE , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , object_file_mode) SI_FP_PROP(FP_SI_PI_SAVED_USER_ID , SI_PI_SAVED_USER_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , saved_user_id) SI_FP_PROP(FP_SI_PI_SAVED_GROUP_ID , SI_PI_SAVED_GROUP_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , saved_group_id) SI_FP_PROP(FP_SI_PI_AUDIT_USER_ID , SI_PI_AUDIT_USER_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , audit_user_id) SI_FP_PROP(FP_SI_PI_AUDIT_SESSION_ID , SI_PI_AUDIT_SESSION_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , audit_session_id) SI_FP_PROP(FP_SI_PI_PROCESS_ID_VERSION , SI_PI_PROCESS_ID_VERSION , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , process_id_version) SI_FP_PROP(FP_SI_PI_FILE_ATTRIBUTES , SI_PI_FILE_ATTRIBUTES , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , object_file_attributes) SI_FP_PROP(FP_SI_PI_FILE_CHANGE_TIME , SI_PI_FILE_CHANGE_TIME , FP_SI_VT_TIMESPEC_TYPE , SiTimeSpec , object_file_change_time) SI_FP_PROP(FP_SI_PI_FILE_ACCESS_TIME , SI_PI_FILE_ACCESS_TIME , FP_SI_VT_TIMESPEC_TYPE , SiTimeSpec , object_file_access_time) SI_FP_PROP(FP_SI_PI_FILE_MODIFICATION_TIME , SI_PI_FILE_MODIFICATION_TIME , FP_SI_VT_TIMESPEC_TYPE , SiTimeSpec , object_file_modification_time) SI_FP_PROP(FP_SI_PI_FILE_BIRTH_TIME , SI_PI_FILE_BIRTH_TIME , FP_SI_VT_TIMESPEC_TYPE , SiTimeSpec , object_file_birth_time) SI_FP_PROP(FP_SI_PI_FILE_SIZE , SI_PI_PRIVATE_FILE_SIZE , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , object_file_size) SI_FP_PROP(FP_SI_PI_FILE_UID , SI_PI_PRIVATE_FILE_UID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , object_file_uid) SI_FP_PROP(FP_SI_PI_FILE_GID , SI_PI_PRIVATE_FILE_GID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , object_file_gid) // 'Private' fields SI_FP_PROP(FP_SI_PI_FSUID , SI_PI_PRIVATE_FSUID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , fsuid) SI_FP_PROP(FP_SI_PI_FSGID , SI_PI_PRIVATE_FSGID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , fsgid) SI_FP_PROP(FP_SI_PI_PARENT_THREAD_ID , SI_PI_PRIVATE_PARENT_THREAD_ID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , parent_thread_id) SI_FP_PROP(FP_SI_PI_OBJECT_FILE_GENERATION , SI_PI_PRIVATE_OBJECT_FILE_GENERATION , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , object_file_generation) SI_FP_PROP(FP_SI_PI_TARGET_FILE_GENERATION , SI_PI_PRIVATE_TARGET_FILE_GENERATION , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , target_file_generation) SI_FP_PROP(FP_SI_PI_OBJECT_FILE_PTR , SI_PI_PRIVATE_OBJECT_FILE_PTR , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , object_file_ptr) SI_FP_PROP(FP_SI_PI_TARGET_FILE_PTR , SI_PI_PRIVATE_TARGET_FILE_PTR , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , target_file_ptr) SI_FP_PROP(FP_SI_PI_OBJECT_FILE_MOUNT_ID , SI_PI_PRIVATE_OBJECT_FILE_MOUNT_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , object_file_mount_id) SI_FP_PROP(FP_SI_PI_TARGET_FILE_MOUNT_ID , SI_PI_PRIVATE_TARGET_FILE_MOUNT_ID , FP_SI_VT_SIGNED32_TYPE , int32_t , target_file_mount_id) SI_FP_PROP_HANDLE(FP_SI_PI_OBJECT_FILE_HANDLE , SI_PI_OBJECT_FILE_HANDLE , FP_SI_VT_FILE_HANDLE_TYPE, const file_handle_info_t* , object_file_handle) SI_FP_PROP_HANDLE(FP_SI_PI_TARGET_FILE_HANDLE , SI_PI_PRIVATE_TARGET_FILE_HANDLE , FP_SI_VT_FILE_HANDLE_TYPE, const file_handle_info_t* , target_file_handle) SI_FP_PROP(FP_SI_PI_TARGET_EXISTS , SI_PI_PRIVATE_TARGET_EXISTS , FP_SI_VT_BOOLEAN_TYPE , bool , target_exists) SI_FP_PROP(FP_SI_PI_TARGET_FILE_ATTRIBUTES , SI_PI_PRIVATE_TARGET_FILE_ATTRIBUTES , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , target_file_attributes) SI_FP_PROP(FP_SI_PI_TARGET_FILE_MODE , SI_PI_PRIVATE_TARGET_FILE_MODE , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , target_file_mode) SI_FP_PROP(FP_SI_PI_TARGET_FILE_SIZE , SI_PI_PRIVATE_TARGET_FILE_SIZE , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , target_file_size) SI_FP_PROP(FP_SI_PI_TARGET_FILE_UID , SI_PI_PRIVATE_TARGET_FILE_UID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , target_file_uid) SI_FP_PROP(FP_SI_PI_TARGET_FILE_GID , SI_PI_PRIVATE_TARGET_FILE_GID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , target_file_gid) SI_FP_PROP(FP_SI_PI_TARGET_FILE_CHANGE_TIME , SI_PI_PRIVATE_TARGET_FILE_CHANGE_TIME , FP_SI_VT_TIMESPEC_TYPE , SiTimeSpec , target_file_change_time) SI_FP_PROP(FP_SI_PI_TARGET_FILE_ACCESS_TIME , SI_PI_PRIVATE_TARGET_FILE_ACCESS_TIME , FP_SI_VT_TIMESPEC_TYPE , SiTimeSpec , target_file_access_time) SI_FP_PROP(FP_SI_PI_TARGET_FILE_MODIFICATION_TIME , SI_PI_PRIVATE_TARGET_FILE_MODIFICATION_TIME , FP_SI_VT_TIMESPEC_TYPE , SiTimeSpec , target_file_modification_time) SI_FP_PROP(FP_SI_PI_TARGET_FILE_BIRTH_TIME , SI_PI_PRIVATE_TARGET_FILE_BIRTH_TIME , FP_SI_VT_TIMESPEC_TYPE , SiTimeSpec , target_file_birth_time) SI_FP_PROP(FP_SI_PI_OTHER_PROCESS_UID , SI_PI_PROCESS_UID , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , other_process_uid) SI_FP_PROP(FP_SI_PI_OTHER_PROCESS_ID , SI_PI_PRIVATE_OTHER_PROCESS_ID , FP_SI_VT_UNSIGNED32_TYPE , uint32_t , other_process_id) SI_FP_PROP(FP_SI_PI_OTHER_PROCESS_ID_VERSION , SI_PI_PRIVATE_OTHER_PROCESS_ID_VERSION , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , other_process_id_version) SI_FP_PROP(FP_SI_PI_OTHER_ARTIFICIAL_PROCESS_START_TIMESTAMP , SI_PI_PRIVATE_OTHER_ARTIFICIAL_PROCESS_START_TIMESTAMP, FP_SI_VT_UNSIGNED64_TYPE , SiTimeMicroseconds , other_artificial_process_start_timestamp) SI_FP_PROP(FP_SI_PI_OTHER_PROCESS_START_TIMESTAMP , SI_PI_PRIVATE_OTHER_PROCESS_START_TIMESTAMP , FP_SI_VT_UNSIGNED64_TYPE , SiTimeMicroseconds , other_process_start_timestamp) SI_FP_PROP(FP_SI_PI_PARENT_PROCESS_ID_VERSION , SI_PI_PRIVATE_PARENT_PROCESS_ID_VERSION , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , parent_process_id_version) SI_FP_PROP(FP_SI_PI_UNIX_EXEC_TYPE , SI_PI_UNIX_EXEC_TYPE , FP_SI_VT_UNSIGNED8_TYPE , uint8_t , unix_exec_type) SI_FP_PROP(FP_SI_PI_VOLUME_ID_LOW , SI_PI_VOLUME_ID_LOW , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , volume_id_low) SI_FP_PROP(FP_SI_PI_VOLUME_ID_HIGH , SI_PI_VOLUME_ID_HIGH , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , volume_id_high) SI_FP_PROP(FP_SI_PI_VOLUME_MAGIC , SI_PI_PRIVATE_VOLUME_MAGIC , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , volume_magic) SI_FP_PROP(FP_SI_PI_COMMAND_LINE_TRUNCATED , SI_PI_PRIVATE_COMMAND_LINE_TRUNCATED , FP_SI_VT_BOOLEAN_TYPE , bool , command_line_cache_truncated) SI_FP_PROP_SIZED(FP_SI_PI_CURRENT_WORKING_DIRECTORY , SI_PI_CURRENT_WORKING_DIRECTORY , FP_SI_VT_UTF8_STRING_TYPE, SiSizedString , current_working_directory) SI_FP_PROP_SIZED(FP_SI_PI_CGROUP_NAME , SI_PI_CGROUP_NAME , FP_SI_VT_UTF8_STRING_TYPE, SiSizedString , cgroup_name) SI_FP_PROP_SIZED(FP_SI_PI_LOG_STR , SI_PI_PRIVATE_LOG_STR , FP_SI_VT_UTF8_STRING_TYPE, SiSizedString , log_str) SI_FP_PROP(FP_SI_PI_FILE_MODIFIED , SI_PI_FILE_MODIFIED , FP_SI_VT_BOOLEAN_TYPE , bool , file_modified) SI_FP_PROP(FP_SI_PI_OBJECT_FILE_DENTRY_PTR , SI_PI_PRIVATE_OBJECT_FILE_DENTRY_PTR , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , object_file_dentry_ptr) SI_FP_PROP(FP_SI_PI_OBJECT_FILE_DENTRY_NAME_PTR , SI_PI_PRIVATE_OBJECT_FILE_DENTRY_NAME_PTR , FP_SI_VT_UNSIGNED64_TYPE , uint64_t , object_file_dentry_name_ptr)