ps

type Snapshotter interface {
	// Write appends a new process state to the snapshotter. It takes as an input the inbound kernel event to fetch
	// the basic data, but also enriches the process' state with extra metadata such as process' env variables, PE
	// metadata for Windows binaries and so on.
	Write(kevt *kevent.Kevent) error
	// WriteFromKcap appends a new process state to the snapshotter from the captured kernel event.
	WriteFromKcap(kevt *kevent.Kevent) error
	// Remove deletes process's state from the snapshotter.
	Remove(kevt *kevent.Kevent) error
	// Find attempts to retrieve process' state for the specified process identifier.
	Find(pid uint32) *pstypes.PS
	// Size returns the total number of process state items.
	Size() uint32
	// Close closes process snapshotter and disposes all allocated resources.
	Close() error
}

type SnapshotterMock struct {
	mock.Mock
}