Comment out PID extraction in RawEventProcessor for debugging purposes

microsoft · Jan 9, 2025 · 7c14deb · 7c14deb
1 parent fc26819
commit 7c14deb
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/RawEventProcessor.cpp b/RawEventProcessor.cpp
@@ -54,12 +54,12 @@ void RawEventProcessor::ProcessData(const void* data, size_t data_len) {
 
     if (rtype == RecordType::SYSCALL || rtype == RecordType::EXECVE || rtype == RecordType::CWD || rtype == RecordType::PATH ||
                 rtype == RecordType::SOCKADDR || rtype == RecordType::INTEGRITY_RULE) {
-        _pid = get_pid_from_event(event);
+        /*_pid = get_pid_from_event(event);
         if (_pid != -1) {
             if (_processTree) {  
                 _processTree->ReadProcEntry(_pid);
             }
-        }
+        }*/
 
         if (!process_syscall_event(event)) {
             process_event(event);