refactor(ps)!: Adjust CreateProcess event process state attribution

Author: rabbitstack

pkg/ps/snapshotter_windows.go

@@ -20,15 +20,16 @@ package ps
 
 import (
 	"expvar"
-	"github.com/rabbitstack/fibratus/pkg/sys"
-	"github.com/rabbitstack/fibratus/pkg/util/va"
-	"golang.org/x/sys/windows"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
+	"github.com/rabbitstack/fibratus/pkg/sys"
+	"github.com/rabbitstack/fibratus/pkg/util/va"
+	"golang.org/x/sys/windows"
+
 	"github.com/rabbitstack/fibratus/pkg/config"
 	"github.com/rabbitstack/fibratus/pkg/event"
 	"github.com/rabbitstack/fibratus/pkg/event/params"
@@ -195,18 +196,8 @@ func (s *snapshotter) Write(e *event.Event) error {
 		s.procs[pid] = proc
 	}
 
-	// adjust the process which is generating
-	// the event. For `CreateProcess` events
-	// the process context is scoped to the
-	// parent/creator process. Otherwise, it
-	// is a regular rundown event that doesn't
-	// require consulting the process in the
-	// snapshot state
-	if e.IsProcessRundown() {
-		e.PS = proc
-	} else if !e.IsProcessRundownInternal() && !e.IsCreateProcessInternal() {
-		e.PS = s.procs[e.PID]
-	}
+	// assign process state to the event
+	e.PS = proc
 
 	return err
 }

pkg/ps/snapshotter_windows_test.go

@@ -19,6 +19,12 @@
 package ps
 
 import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
 	"github.com/rabbitstack/fibratus/pkg/config"
 	"github.com/rabbitstack/fibratus/pkg/event"
 	"github.com/rabbitstack/fibratus/pkg/event/params"
@@ -31,11 +37,6 @@ import (
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/sys/windows"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
 )
 
 func TestWrite(t *testing.T) {
@@ -175,11 +176,7 @@ func TestWrite(t *testing.T) {
 			assert.True(t, (ps.Parent != nil) == (proc.Parent != nil))
 			if found, _ := psnap.Find(evt.PID); found {
 				assert.NotNil(t, evt.PS)
-				if evt.IsProcessRundown() {
-					assert.Equal(t, ps.PID, evt.PS.PID)
-				} else {
-					assert.Equal(t, ps.Ppid, evt.PS.PID)
-				}
+				assert.Equal(t, ps.PID, evt.PS.PID)
 			}
 		})
 	}