@cryptotaxi247 / netdata-1 / commits / 12f8c9537

Windows Events Log Explorer improvements 3 (#18564)

more accurate keywords

Costa Tsaousis committed Sep 17, 2024 at 01:38 UTC 12f8c9537eaa83119c88c3a009b78359aeed164f
5 files changed +260 -135
src/collectors/windows-events.plugin/windows-events-publishers.c
+14 -6
@@ -26,7 +26,7 @@ struct provider_data {
26 };
27
28 struct provider_list {
29 - uint64_t min, max;
29 + uint64_t min, max, mask;
30 bool exceeds_data_type; // true when the manifest values exceed the capacity of the EvtXXX() API
31 uint32_t total; // the number of entries in the array
32 struct provider_data *array; // the array of entries, sorted (for binary search)
@@ -340,7 +340,7 @@ static void publisher_load_list(PROVIDER_META_HANDLE *h, WEVT_VARIANT *content,
340 l->array = callocz(itemCount, sizeof(struct provider_data));
341 l->total = itemCount;
342
343 - uint64_t min = UINT64_MAX, max = 0;
343 + uint64_t min = UINT64_MAX, max = 0, mask = 0;
344
345 // Iterate over the list and populate the entries
346 for (DWORD i = 0; i < itemCount; ++i) {
@@ -364,6 +364,8 @@ static void publisher_load_list(PROVIDER_META_HANDLE *h, WEVT_VARIANT *content,
364 if(d->value > max)
365 max = d->value;
366
367 + mask |= d->value;
368 +
369 if(!is_valid(d->value, false))
370 l->exceeds_data_type = true;
371 }
@@ -396,6 +398,7 @@ static void publisher_load_list(PROVIDER_META_HANDLE *h, WEVT_VARIANT *content,
398
399 l->min = min;
400 l->max = max;
401 + l->mask = mask;
402
403 if(itemCount > 1 && compare_func != NULL) {
404 // Sort the array based on the value (ascending for all except keywords, descending for keywords)
@@ -412,11 +415,16 @@ cleanup:
415
416 // lookup bitmap metdata (returns a comma separated list of strings)
417 static bool publisher_bitmap_metadata(TXT_UTF8 *dst, struct provider_list *l, uint64_t value) {
415 - if(value < l->min || value > l->max || !l->total || !l->array || l->exceeds_data_type)
418 + if(!(value & l->mask) || !l->total || !l->array || l->exceeds_data_type)
419 return false;
420
418 - dst->used = 0;
421 + // do not empty the buffer, there may be reserved keywords in it
422 + // dst->used = 0;
423
424 + if(dst->used)
425 + dst->used--;
426 +
427 + size_t added = 0;
428 for(size_t k = 0; value && k < l->total; k++) {
429 struct provider_data *d = &l->array[k];
430
@@ -438,6 +446,7 @@ static bool publisher_bitmap_metadata(TXT_UTF8 *dst, struct provider_list *l, ui
446 memcpy(&dst->data[dst->used], s, slen);
447 dst->used += slen;
448 dst->src = TXT_SOURCE_PUBLISHER;
449 + added++;
450 }
451 }
452
@@ -447,8 +456,7 @@ static bool publisher_bitmap_metadata(TXT_UTF8 *dst, struct provider_list *l, ui
456 }
457
458 fatal_assert(dst->used <= dst->size);
450 -
451 - return (dst->used > 0);
459 + return added;
460 }
461
462 //// lookup a single value (returns its string)
src/collectors/windows-events.plugin/windows-events-query.c
+82 -117
@@ -156,30 +156,25 @@ static void wevt_get_field_from_cache(
156 field_cache_set(cache_type, provider, value, dst);
157 }
158
159 +#define SET_LEN_AND_RETURN(constant) *len = sizeof(constant) - 1; return constant
160 +
161 static inline const char *wevt_level_hardcoded(uint64_t level, size_t *len) {
162 switch(level) {
161 - case 0: *len = 4; return "None";
162 - case 1: *len = 8; return "Critical";
163 - case 2: *len = 5; return "Error";
164 - case 3: *len = 7; return "Warning";
165 - case 4: *len = 11; return "Information";
166 - case 5: *len = 7; return "Verbose";
167 - default: return NULL;
163 + case WINEVENT_LEVEL_NONE: SET_LEN_AND_RETURN(WINEVENT_NAME_NONE);
164 + case WINEVENT_LEVEL_CRITICAL: SET_LEN_AND_RETURN(WINEVENT_NAME_CRITICAL);
165 + case WINEVENT_LEVEL_ERROR: SET_LEN_AND_RETURN(WINEVENT_NAME_ERROR);
166 + case WINEVENT_LEVEL_WARNING: SET_LEN_AND_RETURN(WINEVENT_NAME_WARNING);
167 + case WINEVENT_LEVEL_INFORMATION: SET_LEN_AND_RETURN(WINEVENT_NAME_INFORMATION);
168 + case WINEVENT_LEVEL_VERBOSE: SET_LEN_AND_RETURN(WINEVENT_NAME_VERBOSE);
169 + default: *len = 0; return NULL;
170 }
171 }
172
171 -static const char *wevt_level_default(uint64_t level, size_t *len) {
172 - static __thread char buf[6 + UINT64_MAX_LENGTH + 1];
173 - strcpy(buf, "Level ");
174 - *len = 6 + print_uint64(&buf[6], level);
175 - return buf;
176 -}
177 -
173 static void wevt_get_level(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE *h) {
174 TXT_UTF8 *dst = &log->ops.level;
175 uint64_t value = ev->level;
176
182 - dst->used = 0; // empty our response
177 + wevt_utf8_empty(dst);
178
179 EVT_FORMAT_MESSAGE_FLAGS flags = EvtFormatMessageLevel;
180 WEVT_FIELD_TYPE cache_type = WEVT_FIELD_TYPE_LEVEL;
@@ -189,9 +184,7 @@ static void wevt_get_level(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE *
184 size_t len;
185 const char *hardcoded = wevt_level_hardcoded(value, &len);
186 if(hardcoded) {
192 - txt_utf8_resize(dst, len + 1, false);
193 - memcpy(dst->data, hardcoded, len + 1);
194 - dst->used = len + 1;
187 + txt_utf8_set(dst, hardcoded, len);
188 dst->src = TXT_SOURCE_HARDCODED;
189 }
190 else {
@@ -205,45 +198,32 @@ static void wevt_get_level(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE *
198 wevt_get_field_from_cache(log, value, h, dst, &ev->provider, cache_type, flags);
199 }
200
208 - if(dst->used <= 1) {
209 - // an empty value, provide something meaningful
210 - size_t len = 0;
211 - const char *s = wevt_level_default(value, &len);
212 - txt_utf8_resize(dst, len + 1, false);
213 - memcpy(dst->data, s, len + 1);
214 - dst->used = len + 1;
215 - }
201 + txt_utf8_set_numeric_if_empty(
202 + dst, WINEVENT_NAME_LEVEL_PREFIX, sizeof(WINEVENT_NAME_LEVEL_PREFIX) - 1, ev->level);
203 }
204
218 -static const char *wevt_opcode_hardcoded(uint64_t level, size_t *len) {
219 - switch(level) {
220 - case 0: *len = 4; return "Info";
221 - case 1: *len = 5; return "Start";
222 - case 2: *len = 4; return "Stop";
223 - case 3: *len = 8; return "DC Start";
224 - case 4: *len = 7; return "DC Stop";
225 - case 5: *len = 9; return "Extension";
226 - case 6: *len = 5; return "Reply";
227 - case 7: *len = 6; return "Resume";
228 - case 8: *len = 7; return "Suspend";
229 - case 9: *len = 4; return "Send";
230 - case 240: *len = 7; return "Receive";
205 +static inline const char *wevt_opcode_hardcoded(uint64_t opcode, size_t *len) {
206 + switch(opcode) {
207 + case WINEVENT_OPCODE_INFO: SET_LEN_AND_RETURN(WINEVENT_NAME_INFO);
208 + case WINEVENT_OPCODE_START: SET_LEN_AND_RETURN(WINEVENT_NAME_START);
209 + case WINEVENT_OPCODE_STOP: SET_LEN_AND_RETURN(WINEVENT_NAME_STOP);
210 + case WINEVENT_OPCODE_DC_START: SET_LEN_AND_RETURN(WINEVENT_NAME_DC_START);
211 + case WINEVENT_OPCODE_DC_STOP: SET_LEN_AND_RETURN(WINEVENT_NAME_DC_STOP);
212 + case WINEVENT_OPCODE_EXTENSION: SET_LEN_AND_RETURN(WINEVENT_NAME_EXTENSION);
213 + case WINEVENT_OPCODE_REPLY: SET_LEN_AND_RETURN(WINEVENT_NAME_REPLY);
214 + case WINEVENT_OPCODE_RESUME: SET_LEN_AND_RETURN(WINEVENT_NAME_RESUME);
215 + case WINEVENT_OPCODE_SUSPEND: SET_LEN_AND_RETURN(WINEVENT_NAME_SUSPEND);
216 + case WINEVENT_OPCODE_SEND: SET_LEN_AND_RETURN(WINEVENT_NAME_SEND);
217 + case WINEVENT_OPCODE_RECEIVE: SET_LEN_AND_RETURN(WINEVENT_NAME_RECEIVE);
218 default: *len = 0; return NULL;
219 }
220 }
221
235 -static const char *wevt_opcode_default(uint64_t opcode, size_t *len) {
236 - static __thread char buf[7 + UINT64_MAX_LENGTH + 1];
237 - strcpy(buf, "Opcode ");
238 - *len = 7 + print_uint64(&buf[7], opcode);
239 - return buf;
240 -}
241 -
222 static void wevt_get_opcode(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE *h) {
223 TXT_UTF8 *dst = &log->ops.opcode;
224 uint64_t value = ev->opcode;
225
246 - dst->used = 0; // empty our response
226 + wevt_utf8_empty(dst);
227
228 EVT_FORMAT_MESSAGE_FLAGS flags = EvtFormatMessageOpcode;
229 WEVT_FIELD_TYPE cache_type = WEVT_FIELD_TYPE_OPCODE;
@@ -253,9 +233,7 @@ static void wevt_get_opcode(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE
233 size_t len;
234 const char *hardcoded = wevt_opcode_hardcoded(value, &len);
235 if(hardcoded) {
256 - txt_utf8_resize(dst, len + 1, false);
257 - memcpy(dst->data, hardcoded, len + 1);
258 - dst->used = len + 1;
236 + txt_utf8_set(dst, hardcoded, len);
237 dst->src = TXT_SOURCE_HARDCODED;
238 }
239 else {
@@ -269,35 +247,22 @@ static void wevt_get_opcode(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE
247 wevt_get_field_from_cache(log, value, h, dst, &ev->provider, cache_type, flags);
248 }
249
272 - if(dst->used <= 1) {
273 - // an empty value, provide something meaningful
274 - size_t len = 0;
275 - const char *s = wevt_opcode_default(value, &len);
276 - txt_utf8_resize(dst, len + 1, false);
277 - memcpy(dst->data, s, len + 1);
278 - dst->used = len + 1;
279 - }
250 + txt_utf8_set_numeric_if_empty(
251 + dst, WINEVENT_NAME_OPCODE_PREFIX, sizeof(WINEVENT_NAME_OPCODE_PREFIX) - 1, ev->opcode);
252 }
253
254 static const char *wevt_task_hardcoded(uint64_t task, size_t *len) {
255 switch(task) {
284 - case 0: *len = 4; return "None";
256 + case WINEVENT_TASK_NONE: SET_LEN_AND_RETURN(WINEVENT_NAME_NONE);
257 default: *len = 0; return NULL;
258 }
259 }
260
289 -static const char *wevt_task_default(uint64_t task, size_t *len) {
290 - static __thread char buf[5 + UINT64_MAX_LENGTH + 1];
291 - strcpy(buf, "Task ");
292 - *len = 5 + print_uint64(&buf[5], task);
293 - return buf;
294 -}
295 -
261 static void wevt_get_task(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE *h) {
262 TXT_UTF8 *dst = &log->ops.task;
263 uint64_t value = ev->task;
264
300 - dst->used = 0; // empty our response
265 + wevt_utf8_empty(dst);
266
267 EVT_FORMAT_MESSAGE_FLAGS flags = EvtFormatMessageTask;
268 WEVT_FIELD_TYPE cache_type = WEVT_FIELD_TYPE_TASK;
@@ -307,9 +272,7 @@ static void wevt_get_task(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE *h
272 size_t len;
273 const char *hardcoded = wevt_task_hardcoded(value, &len);
274 if(hardcoded) {
310 - txt_utf8_resize(dst, len + 1, false);
311 - memcpy(dst->data, hardcoded, len + 1);
312 - dst->used = len + 1;
275 + txt_utf8_set(dst, hardcoded, len);
276 dst->src = TXT_SOURCE_HARDCODED;
277 }
278 else {
@@ -323,70 +286,72 @@ static void wevt_get_task(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE *h
286 wevt_get_field_from_cache(log, value, h, dst, &ev->provider, cache_type, flags);
287 }
288
326 - if(dst->used <= 1) {
327 - // an empty value, provide something meaningful
328 - size_t len = 0;
329 - const char *s = wevt_task_default(value, &len);
330 - txt_utf8_resize(dst, len + 1, false);
331 - memcpy(dst->data, s, len + 1);
332 - dst->used = len + 1;
333 - }
289 + txt_utf8_set_numeric_if_empty(
290 + dst, WINEVENT_NAME_TASK_PREFIX, sizeof(WINEVENT_NAME_TASK_PREFIX) - 1, ev->task);
291 }
292
336 -static const char *wevt_keywords_hardcoded(uint64_t keywords, size_t *len) {
337 - switch(keywords) {
338 - case 0: *len = 4; return "None";
339 - default: *len = 0; return NULL;
293 +#define SET_BITS(msk, txt) { .mask = msk, .name = txt, .len = sizeof(txt) - 1, }
294 +
295 +static uint64_t wevt_keywords_handle_reserved(uint64_t value, TXT_UTF8 *dst) {
296 + struct {
297 + uint64_t mask;
298 + const char *name;
299 + size_t len;
300 + } bits[] = {
301 + SET_BITS(WINEVENT_KEYWORD_EVENTLOG_CLASSIC, WINEVENT_NAME_EVENTLOG_CLASSIC),
302 + SET_BITS(WINEVENT_KEYWORD_CORRELATION_HINT, WINEVENT_NAME_CORRELATION_HINT),
303 + SET_BITS(WINEVENT_KEYWORD_AUDIT_SUCCESS, WINEVENT_NAME_AUDIT_SUCCESS),
304 + SET_BITS(WINEVENT_KEYWORD_AUDIT_FAILURE, WINEVENT_NAME_AUDIT_FAILURE),
305 + SET_BITS(WINEVENT_KEYWORD_SQM, WINEVENT_NAME_SQM),
306 + SET_BITS(WINEVENT_KEYWORD_WDI_DIAG, WINEVENT_NAME_WDI_DIAG),
307 + SET_BITS(WINEVENT_KEYWORD_WDI_CONTEXT, WINEVENT_NAME_WDI_CONTEXT),
308 + SET_BITS(WINEVENT_KEYWORD_RESPONSE_TIME, WINEVENT_NAME_RESPONSE_TIME),
309 + };
310 +
311 + wevt_utf8_empty(dst);
312 +
313 + for(size_t i = 0; i < sizeof(bits) / sizeof(bits[0]) ;i++) {
314 + if((value & bits[i].mask) == bits[i].mask) {
315 + txt_utf8_add_keywords_separator_if_needed(dst);
316 + txt_utf8_append(dst, bits[i].name, bits[i].len);
317 + value &= ~(bits[i].mask);
318 + dst->src = TXT_SOURCE_HARDCODED;
319 + }
320 }
341 -}
321
343 -static const char *wevt_keywords_default(uint64_t task, size_t *len) {
344 - static __thread char buf[9 + UINT64_MAX_LENGTH + 1];
345 - strcpy(buf, "Keywords ");
346 - *len = 9 + print_uint64(&buf[9], task);
347 - return buf;
322 + // return it without any remaining reserved bits
323 + return value & 0x0000FFFFFFFFFFFF;
324 }
325
326 static void wevt_get_keywords(WEVT_LOG *log, WEVT_EVENT *ev, PROVIDER_META_HANDLE *h) {
327 TXT_UTF8 *dst = &log->ops.keywords;
328
353 - // microsoft suggests the high 16 bits are for internal use
354 - uint64_t value = ev->keywords & 0x0000FFFFFFFFFFFF;
329 + if(ev->keywords == WINEVT_KEYWORD_NONE) {
330 + txt_utf8_resize(dst, sizeof(WINEVENT_NAME_NONE), false);
331 + memcpy(dst->data, WINEVENT_NAME_NONE, sizeof(WINEVENT_NAME_NONE));
332 + dst->used = sizeof(WINEVENT_NAME_NONE);
333 + dst->src = TXT_SOURCE_HARDCODED;
334 + }
335
356 - dst->used = 0; // empty our response
336 + uint64_t value = wevt_keywords_handle_reserved(ev->keywords, dst);
337
338 EVT_FORMAT_MESSAGE_FLAGS flags = EvtFormatMessageKeyword;
339 WEVT_FIELD_TYPE cache_type = WEVT_FIELD_TYPE_KEYWORDS;
360 - bool is_publisher = is_valid_publisher_keywords(value, true);
340
362 - if(!is_publisher) {
363 - size_t len;
364 - const char *hardcoded = wevt_keywords_hardcoded(value, &len);
365 - if(hardcoded) {
366 - txt_utf8_resize(dst, len + 1, false);
367 - memcpy(dst->data, hardcoded, len + 1);
368 - dst->used = len + 1;
369 - dst->src = TXT_SOURCE_HARDCODED;
370 - }
371 - else {
372 - // since this is not a publisher value
373 - // we expect to get the system description of it
374 - wevt_get_field_from_cache(log, value, h, dst, &ev->provider, cache_type, flags);
375 - }
341 + if(!value && dst->used <= 1) {
342 + // no hardcoded info in the buffer, make it None
343 + txt_utf8_set(dst, WINEVENT_NAME_NONE, sizeof(WINEVENT_NAME_NONE) - 1);
344 + dst->src = TXT_SOURCE_HARDCODED;
345 }
377 - else if (!publisher_get_keywords(dst, h, value)) {
378 - // not found in the manifest, get it from the cache
379 - wevt_get_field_from_cache(log, value, h, dst, &ev->provider, cache_type, flags);
346 + else if (value && !publisher_get_keywords(dst, h, value) && dst->used <= 1) {
347 + // the publisher did not provide any info and the description is still empty.
348 + // the system returns 1 keyword, the highest bit, not a list
349 + // so, when we call the system, we pass the original value (ev->keywords)
350 + wevt_get_field_from_cache(log, ev->keywords, h, dst, &ev->provider, cache_type, flags);
351 }
352
382 - if(dst->used <= 1) {
383 - // an empty value, provide something meaningful
384 - size_t len = 0;
385 - const char *s = wevt_keywords_default(value, &len);
386 - txt_utf8_resize(dst, len + 1, false);
387 - memcpy(dst->data, s, len + 1);
388 - dst->used = len + 1;
389 - }
353 + txt_utf8_set_hex_if_empty(
354 + dst, WINEVENT_NAME_KEYWORDS_PREFIX, sizeof(WINEVENT_NAME_KEYWORDS_PREFIX) - 1, ev->keywords);
355 }
356
357 bool wevt_get_next_event_one(WEVT_LOG *log, WEVT_EVENT *ev, bool full) {
src/collectors/windows-events.plugin/windows-events-unicode.h
+47 -1
@@ -43,6 +43,8 @@ static inline size_t compute_new_size(size_t old_size, size_t required_size) {
43
44 static inline void txt_utf8_cleanup(TXT_UTF8 *utf8) {
45 freez(utf8->data);
46 + utf8->data = NULL;
47 + utf8->used = 0;
48 }
49
50 static inline void txt_utf8_resize(TXT_UTF8 *utf8, size_t required_size, bool keep) {
@@ -58,6 +60,50 @@ static inline void txt_utf8_resize(TXT_UTF8 *utf8, size_t required_size, bool ke
60 txt_utf8_cleanup(utf8);
61 utf8->size = compute_new_size(utf8->size, required_size);
62 utf8->data = mallocz(utf8->size);
63 + utf8->used = 0;
64 + }
65 +}
66 +
67 +static inline void txt_utf8_set(TXT_UTF8 *dst, const char *txt, size_t txt_len) {
68 + txt_utf8_resize(dst, dst->used + txt_len + 1, true);
69 + memcpy(dst->data, txt, txt_len);
70 + dst->used = txt_len + 1;
71 + dst->data[dst->used - 1] = '\0';
72 +}
73 +
74 +static inline void txt_utf8_append(TXT_UTF8 *dst, const char *txt, size_t txt_len) {
75 + if(dst->used <= 1) {
76 + // the destination is empty
77 + txt_utf8_set(dst, txt, txt_len);
78 + }
79 + else {
80 + // there is something already in the buffer
81 + txt_utf8_resize(dst, dst->used + txt_len, true);
82 + memcpy(&dst->data[dst->used - 1], txt, txt_len);
83 + dst->used += txt_len; // the null was already counted
84 + dst->data[dst->used - 1] = '\0';
85 + }
86 +}
87 +
88 +#define WINEVENT_NAME_KEYWORDS_SEPARATOR ", "
89 +static inline void txt_utf8_add_keywords_separator_if_needed(TXT_UTF8 *dst) {
90 + if(dst->used > 1)
91 + txt_utf8_append(dst, WINEVENT_NAME_KEYWORDS_SEPARATOR, sizeof(WINEVENT_NAME_KEYWORDS_SEPARATOR) - 1);
92 +}
93 +
94 +static inline void txt_utf8_set_numeric_if_empty(TXT_UTF8 *dst, const char *prefix, size_t len, uint64_t value) {
95 + if(dst->used <= 1) {
96 + txt_utf8_resize(dst, len + UINT64_MAX_LENGTH + 1, false);
97 + memcpy(dst->data, prefix, len);
98 + dst->used = len + print_uint64(&dst->data[len], value) + 1;
99 + }
100 +}
101 +
102 +static inline void txt_utf8_set_hex_if_empty(TXT_UTF8 *dst, const char *prefix, size_t len, uint64_t value) {
103 + if(dst->used <= 1) {
104 + txt_utf8_resize(dst, len + UINT64_HEX_MAX_LENGTH + 1, false);
105 + memcpy(dst->data, prefix, len);
106 + dst->used = len + print_uint64_hex_full(&dst->data[len], value) + 1;
107 }
108 }
109
@@ -75,7 +121,7 @@ static inline void txt_unicode_resize(TXT_UNICODE *unicode, size_t required_size
121 }
122
123 bool wevt_str_unicode_to_utf8(TXT_UTF8 *utf8, TXT_UNICODE *unicode);
78 -bool wevt_str_wchar_to_utf8(TXT_UTF8 *utf8, const wchar_t *src, int src_len_with_null);
124 +bool wevt_str_wchar_to_utf8(TXT_UTF8 *dst, const wchar_t *src, int src_len_with_null);
125
126 void unicode2utf8(char *dst, size_t dst_size, const wchar_t *src);
127 void utf82unicode(wchar_t *dst, size_t dst_size, const char *src);
src/collectors/windows-events.plugin/windows-events.c
+13 -11
@@ -125,14 +125,13 @@ struct lqs_extension {
125 ""
126
127 #define WEVT_KEYS_INCLUDED_IN_FACETS \
128 + "|" WEVT_FIELD_COMPUTER \
129 "|" WEVT_FIELD_PROVIDER \
130 "|" WEVT_FIELD_SOURCE \
130 - "|" WEVT_FIELD_CHANNEL \
131 "|" WEVT_FIELD_LEVEL \
132 "|" WEVT_FIELD_KEYWORDS \
133 "|" WEVT_FIELD_OPCODE \
134 "|" WEVT_FIELD_TASK \
135 - "|" WEVT_FIELD_COMPUTER \
135 "|" WEVT_FIELD_USER \
136 ""
137
@@ -158,15 +157,18 @@ FACET_ROW_SEVERITY wevt_levelid_to_facet_severity(FACETS *facets __maybe_unused,
157 int windows_event_level = str2i(buffer_tostring(levelid_rkv->wb));
158
159 switch (windows_event_level) {
161 - case 5: // Verbose
160 + case WINEVENT_LEVEL_VERBOSE:
161 return FACET_ROW_SEVERITY_DEBUG;
162 +
163 default:
164 - case 4: // Information
164 + case WINEVENT_LEVEL_INFORMATION:
165 return FACET_ROW_SEVERITY_NORMAL;
166 - case 3: // Warning
166 +
167 + case WINEVENT_LEVEL_WARNING:
168 return FACET_ROW_SEVERITY_WARNING;
168 - case 2: // Error
169 - case 1: // Critical
169 +
170 + case WINEVENT_LEVEL_ERROR:
171 + case WINEVENT_LEVEL_CRITICAL:
172 return FACET_ROW_SEVERITY_CRITICAL;
173 }
174 }
@@ -188,7 +190,7 @@ static void wevt_cleanup_bin_data(void *data) {
190 freez(d);
191 }
192
191 -static inline void wevt_facets_register_bin_data(WEVT_LOG *log, FACETS *facets, WEVT_EVENT *ev) {
193 +static inline void wevt_facets_register_bin_data(WEVT_LOG *log, FACETS *facets, WEVT_EVENT *ev __maybe_unused) {
194 struct wevt_bin_data *d = mallocz(sizeof(struct wevt_bin_data));
195
196 d->log = log;
@@ -324,7 +326,7 @@ static void wevt_register_fields(LOGS_QUERY_STATUS *lqs) {
326
327 facets_register_key_name(
328 facets, WEVT_FIELD_CHANNEL,
327 - rq->default_facet | FACET_KEY_OPTION_FTS);
329 + FACET_KEY_OPTION_FTS);
330
331 facets_register_key_name(
332 facets, WEVT_FIELD_PROVIDER,
@@ -353,11 +355,11 @@ static void wevt_register_fields(LOGS_QUERY_STATUS *lqs) {
355
356 facets_register_key_name(
357 facets, WEVT_FIELD_PROCESSID,
356 - rq->default_facet | FACET_KEY_OPTION_FTS);
358 + FACET_KEY_OPTION_FTS);
359
360 facets_register_key_name(
361 facets, WEVT_FIELD_THREADID,
360 - rq->default_facet | FACET_KEY_OPTION_FTS);
362 + FACET_KEY_OPTION_FTS);
363
364 facets_register_key_name(
365 facets, WEVT_FIELD_TASK,
src/collectors/windows-events.plugin/windows-events.h
+104
@@ -19,6 +19,110 @@ typedef enum {
19 WEVT_CANCELLED,
20 } WEVT_QUERY_STATUS;
21
22 +#define WINEVENT_CHANNEL_CLASSIC_TRACE 0x0
23 +#define WINEVENT_CHANNEL_GLOBAL_SYSTEM 0x8
24 +#define WINEVENT_CHANNEL_GLOBAL_APPLICATION 0x9
25 +#define WINEVENT_CHANNEL_GLOBAL_SECURITY 0xa
26 +
27 +#define WINEVENT_LEVEL_NONE 0x0
28 +#define WINEVENT_LEVEL_CRITICAL 0x1
29 +#define WINEVENT_LEVEL_ERROR 0x2
30 +#define WINEVENT_LEVEL_WARNING 0x3
31 +#define WINEVENT_LEVEL_INFORMATION 0x4
32 +#define WINEVENT_LEVEL_VERBOSE 0x5
33 +#define WINEVENT_LEVEL_RESERVED_6 0x6
34 +#define WINEVENT_LEVEL_RESERVED_7 0x7
35 +#define WINEVENT_LEVEL_RESERVED_8 0x8
36 +#define WINEVENT_LEVEL_RESERVED_9 0x9
37 +#define WINEVENT_LEVEL_RESERVED_10 0xa
38 +#define WINEVENT_LEVEL_RESERVED_11 0xb
39 +#define WINEVENT_LEVEL_RESERVED_12 0xc
40 +#define WINEVENT_LEVEL_RESERVED_13 0xd
41 +#define WINEVENT_LEVEL_RESERVED_14 0xe
42 +#define WINEVENT_LEVEL_RESERVED_15 0xf
43 +
44 +#define WINEVENT_OPCODE_INFO 0x0
45 +#define WINEVENT_OPCODE_START 0x1
46 +#define WINEVENT_OPCODE_STOP 0x2
47 +#define WINEVENT_OPCODE_DC_START 0x3
48 +#define WINEVENT_OPCODE_DC_STOP 0x4
49 +#define WINEVENT_OPCODE_EXTENSION 0x5
50 +#define WINEVENT_OPCODE_REPLY 0x6
51 +#define WINEVENT_OPCODE_RESUME 0x7
52 +#define WINEVENT_OPCODE_SUSPEND 0x8
53 +#define WINEVENT_OPCODE_SEND 0x9
54 +#define WINEVENT_OPCODE_RECEIVE 0xf0
55 +#define WINEVENT_OPCODE_RESERVED_241 0xf1
56 +#define WINEVENT_OPCODE_RESERVED_242 0xf2
57 +#define WINEVENT_OPCODE_RESERVED_243 0xf3
58 +#define WINEVENT_OPCODE_RESERVED_244 0xf4
59 +#define WINEVENT_OPCODE_RESERVED_245 0xf5
60 +#define WINEVENT_OPCODE_RESERVED_246 0xf6
61 +#define WINEVENT_OPCODE_RESERVED_247 0xf7
62 +#define WINEVENT_OPCODE_RESERVED_248 0xf8
63 +#define WINEVENT_OPCODE_RESERVED_249 0xf9
64 +#define WINEVENT_OPCODE_RESERVED_250 0xfa
65 +#define WINEVENT_OPCODE_RESERVED_251 0xfb
66 +#define WINEVENT_OPCODE_RESERVED_252 0xfc
67 +#define WINEVENT_OPCODE_RESERVED_253 0xfd
68 +#define WINEVENT_OPCODE_RESERVED_254 0xfe
69 +#define WINEVENT_OPCODE_RESERVED_255 0xff
70 +
71 +#define WINEVENT_TASK_NONE 0x0
72 +
73 +#define WINEVT_KEYWORD_NONE 0x0
74 +#define WINEVENT_KEYWORD_RESPONSE_TIME 0x0001000000000000
75 +#define WINEVENT_KEYWORD_WDI_CONTEXT 0x0002000000000000
76 +#define WINEVENT_KEYWORD_WDI_DIAG 0x0004000000000000
77 +#define WINEVENT_KEYWORD_SQM 0x0008000000000000
78 +#define WINEVENT_KEYWORD_AUDIT_FAILURE 0x0010000000000000
79 +#define WINEVENT_KEYWORD_AUDIT_SUCCESS 0x0020000000000000
80 +#define WINEVENT_KEYWORD_CORRELATION_HINT 0x0040000000000000
81 +#define WINEVENT_KEYWORD_EVENTLOG_CLASSIC 0x0080000000000000
82 +#define WINEVENT_KEYWORD_RESERVED_56 0x0100000000000000
83 +#define WINEVENT_KEYWORD_RESERVED_57 0x0200000000000000
84 +#define WINEVENT_KEYWORD_RESERVED_58 0x0400000000000000
85 +#define WINEVENT_KEYWORD_RESERVED_59 0x0800000000000000
86 +#define WINEVENT_KEYWORDE_RESERVED_60 0x1000000000000000
87 +#define WINEVENT_KEYWORD_RESERVED_61 0x2000000000000000
88 +#define WINEVENT_KEYWORD_RESERVED_62 0x4000000000000000
89 +#define WINEVENT_KEYWORD_RESERVED_63 0x8000000000000000
90 +
91 +#define WINEVENT_NAME_NONE "None"
92 +
93 +#define WINEVENT_NAME_CRITICAL "Critical"
94 +#define WINEVENT_NAME_ERROR "Error"
95 +#define WINEVENT_NAME_WARNING "Warning"
96 +#define WINEVENT_NAME_INFORMATION "Information"
97 +#define WINEVENT_NAME_VERBOSE "Verbose"
98 +
99 +#define WINEVENT_NAME_INFO "Info"
100 +#define WINEVENT_NAME_START "Start"
101 +#define WINEVENT_NAME_STOP "Stop"
102 +#define WINEVENT_NAME_DC_START "DC Start"
103 +#define WINEVENT_NAME_DC_STOP "DC Stop"
104 +#define WINEVENT_NAME_EXTENSION "Extension"
105 +#define WINEVENT_NAME_REPLY "Reply"
106 +#define WINEVENT_NAME_RESUME "Resume"
107 +#define WINEVENT_NAME_SUSPEND "Suspend"
108 +#define WINEVENT_NAME_SEND "Send"
109 +#define WINEVENT_NAME_RECEIVE "Receive"
110 +
111 +#define WINEVENT_NAME_RESPONSE_TIME "Response Time"
112 +#define WINEVENT_NAME_WDI_CONTEXT "WDI Context"
113 +#define WINEVENT_NAME_WDI_DIAG "WDI Diagnostics"
114 +#define WINEVENT_NAME_SQM "SQM (Software Quality Metrics)"
115 +#define WINEVENT_NAME_AUDIT_FAILURE "Audit Failure"
116 +#define WINEVENT_NAME_AUDIT_SUCCESS "Audit Success"
117 +#define WINEVENT_NAME_CORRELATION_HINT "Correlation Hint"
118 +#define WINEVENT_NAME_EVENTLOG_CLASSIC "Event Log Classic"
119 +
120 +#define WINEVENT_NAME_LEVEL_PREFIX "Level "
121 +#define WINEVENT_NAME_KEYWORDS_PREFIX "Keywords "
122 +#define WINEVENT_NAME_OPCODE_PREFIX "Opcode "
123 +#define WINEVENT_NAME_TASK_PREFIX "Task "
124 +
125 +
126 #include "windows-events-unicode.h"
127 #include "windows-events-query.h"
128 #include "windows-events-sources.h"