From 8c6cf2ccdaecb391f710b157aee8c2b35e6ba872 Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui3371@sina.com>
Date: Sat, 17 Sep 2022 11:21:05 +0800
Subject: [PATCH] Swap: add macOS support

---
 src/detection/memory/memory_apple.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/detection/memory/memory_apple.c b/src/detection/memory/memory_apple.c
index 306061313..eb264c78e 100644
--- a/src/detection/memory/memory_apple.c
+++ b/src/detection/memory/memory_apple.c
@@ -1,9 +1,9 @@
 #include "memory.h"
 #include "common/settings.h"
 
-
 #include <string.h>
 #include <mach/mach.h>
+#include <sys/sysctl.h>
 
 void ffDetectMemoryImpl(FFMemoryResult* memory)
 {
@@ -21,4 +21,11 @@ void ffDetectMemoryImpl(FFMemoryResult* memory)
         return;
 
     memory->ram.bytesUsed = ((uint64_t) vmstat.active_count + vmstat.wire_count) * pagesize;
+
+    struct xsw_usage swap;
+    size_t size = sizeof(swap);
+    if (sysctlbyname("vm.swapusage", &swap, &size, 0, 0) == -1)
+        return;
+    memory->swap.bytesTotal = swap.xsu_total;
+    memory->swap.bytesUsed = swap.xsu_used;
 }