| 1 | // SPDX-License-Identifier: GPL-3.0-or-later |
| 2 | |
| 3 | #ifndef NETDATA_WINDOWS_EVENTS_H |
| 4 | #define NETDATA_WINDOWS_EVENTS_H |
| 5 | |
| 6 | #include "libnetdata/libnetdata.h" |
| 7 | #include "collectors/all.h" |
| 8 | |
| 9 | typedef enum { |
| 10 | WEVT_NO_CHANNEL_MATCHED, |
| 11 | WEVT_FAILED_TO_OPEN, |
| 12 | WEVT_FAILED_TO_SEEK, |
| 13 | WEVT_TIMED_OUT, |
| 14 | WEVT_OK, |
| 15 | WEVT_NOT_MODIFIED, |
| 16 | WEVT_CANCELLED, |
| 17 | } WEVT_QUERY_STATUS; |
| 18 | |
| 19 | #define WEVT_CHANNEL_CLASSIC_TRACE 0x0 |
| 20 | #define WEVT_CHANNEL_GLOBAL_SYSTEM 0x8 |
| 21 | #define WEVT_CHANNEL_GLOBAL_APPLICATION 0x9 |
| 22 | #define WEVT_CHANNEL_GLOBAL_SECURITY 0xa |
| 23 | |
| 24 | #define WEVT_LEVEL_NONE 0x0 |
| 25 | #define WEVT_LEVEL_CRITICAL 0x1 |
| 26 | #define WEVT_LEVEL_ERROR 0x2 |
| 27 | #define WEVT_LEVEL_WARNING 0x3 |
| 28 | #define WEVT_LEVEL_INFORMATION 0x4 |
| 29 | #define WEVT_LEVEL_VERBOSE 0x5 |
| 30 | #define WEVT_LEVEL_RESERVED_6 0x6 |
| 31 | #define WEVT_LEVEL_RESERVED_7 0x7 |
| 32 | #define WEVT_LEVEL_RESERVED_8 0x8 |
| 33 | #define WEVT_LEVEL_RESERVED_9 0x9 |
| 34 | #define WEVT_LEVEL_RESERVED_10 0xa |
| 35 | #define WEVT_LEVEL_RESERVED_11 0xb |
| 36 | #define WEVT_LEVEL_RESERVED_12 0xc |
| 37 | #define WEVT_LEVEL_RESERVED_13 0xd |
| 38 | #define WEVT_LEVEL_RESERVED_14 0xe |
| 39 | #define WEVT_LEVEL_RESERVED_15 0xf |
| 40 | |
| 41 | #define WEVT_OPCODE_INFO 0x0 |
| 42 | #define WEVT_OPCODE_START 0x1 |
| 43 | #define WEVT_OPCODE_STOP 0x2 |
| 44 | #define WEVT_OPCODE_DC_START 0x3 |
| 45 | #define WEVT_OPCODE_DC_STOP 0x4 |
| 46 | #define WEVT_OPCODE_EXTENSION 0x5 |
| 47 | #define WEVT_OPCODE_REPLY 0x6 |
| 48 | #define WEVT_OPCODE_RESUME 0x7 |
| 49 | #define WEVT_OPCODE_SUSPEND 0x8 |
| 50 | #define WEVT_OPCODE_SEND 0x9 |
| 51 | #define WEVT_OPCODE_RECEIVE 0xf0 |
| 52 | #define WEVT_OPCODE_RESERVED_241 0xf1 |
| 53 | #define WEVT_OPCODE_RESERVED_242 0xf2 |
| 54 | #define WEVT_OPCODE_RESERVED_243 0xf3 |
| 55 | #define WEVT_OPCODE_RESERVED_244 0xf4 |
| 56 | #define WEVT_OPCODE_RESERVED_245 0xf5 |
| 57 | #define WEVT_OPCODE_RESERVED_246 0xf6 |
| 58 | #define WEVT_OPCODE_RESERVED_247 0xf7 |
| 59 | #define WEVT_OPCODE_RESERVED_248 0xf8 |
| 60 | #define WEVT_OPCODE_RESERVED_249 0xf9 |
| 61 | #define WEVT_OPCODE_RESERVED_250 0xfa |
| 62 | #define WEVT_OPCODE_RESERVED_251 0xfb |
| 63 | #define WEVT_OPCODE_RESERVED_252 0xfc |
| 64 | #define WEVT_OPCODE_RESERVED_253 0xfd |
| 65 | #define WEVT_OPCODE_RESERVED_254 0xfe |
| 66 | #define WEVT_OPCODE_RESERVED_255 0xff |
| 67 | |
| 68 | #define WEVT_TASK_NONE 0x0 |
| 69 | |
| 70 | #define WEVT_KEYWORD_NONE 0x0 |
| 71 | #define WEVT_KEYWORD_RESPONSE_TIME 0x0001000000000000 |
| 72 | #define WEVT_KEYWORD_WDI_CONTEXT 0x0002000000000000 |
| 73 | #define WEVT_KEYWORD_WDI_DIAG 0x0004000000000000 |
| 74 | #define WEVT_KEYWORD_SQM 0x0008000000000000 |
| 75 | #define WEVT_KEYWORD_AUDIT_FAILURE 0x0010000000000000 |
| 76 | #define WEVT_KEYWORD_AUDIT_SUCCESS 0x0020000000000000 |
| 77 | #define WEVT_KEYWORD_CORRELATION_HINT 0x0040000000000000 |
| 78 | #define WEVT_KEYWORD_EVENTLOG_CLASSIC 0x0080000000000000 |
| 79 | #define WEVT_KEYWORD_RESERVED_56 0x0100000000000000 |
| 80 | #define WEVT_KEYWORD_RESERVED_57 0x0200000000000000 |
| 81 | #define WEVT_KEYWORD_RESERVED_58 0x0400000000000000 |
| 82 | #define WEVT_KEYWORD_RESERVED_59 0x0800000000000000 |
| 83 | #define WEVT_KEYWORDE_RESERVED_60 0x1000000000000000 |
| 84 | #define WEVT_KEYWORD_RESERVED_61 0x2000000000000000 |
| 85 | #define WEVT_KEYWORD_RESERVED_62 0x4000000000000000 |
| 86 | #define WEVT_KEYWORD_RESERVED_63 0x8000000000000000 |
| 87 | |
| 88 | #define WEVT_LEVEL_NAME_NONE "None" |
| 89 | #define WEVT_LEVEL_NAME_CRITICAL "Critical" |
| 90 | #define WEVT_LEVEL_NAME_ERROR "Error" |
| 91 | #define WEVT_LEVEL_NAME_WARNING "Warning" |
| 92 | #define WEVT_LEVEL_NAME_INFORMATION "Information" |
| 93 | #define WEVT_LEVEL_NAME_VERBOSE "Verbose" |
| 94 | |
| 95 | #define WEVT_OPCODE_NAME_INFO "Info" |
| 96 | #define WEVT_OPCODE_NAME_START "Start" |
| 97 | #define WEVT_OPCODE_NAME_STOP "Stop" |
| 98 | #define WEVT_OPCODE_NAME_DC_START "DC Start" |
| 99 | #define WEVT_OPCODE_NAME_DC_STOP "DC Stop" |
| 100 | #define WEVT_OPCODE_NAME_EXTENSION "Extension" |
| 101 | #define WEVT_OPCODE_NAME_REPLY "Reply" |
| 102 | #define WEVT_OPCODE_NAME_RESUME "Resume" |
| 103 | #define WEVT_OPCODE_NAME_SUSPEND "Suspend" |
| 104 | #define WEVT_OPCODE_NAME_SEND "Send" |
| 105 | #define WEVT_OPCODE_NAME_RECEIVE "Receive" |
| 106 | |
| 107 | #define WEVT_TASK_NAME_NONE "None" |
| 108 | |
| 109 | #define WEVT_KEYWORD_NAME_NONE "None" |
| 110 | #define WEVT_KEYWORD_NAME_RESPONSE_TIME "Response Time" |
| 111 | #define WEVT_KEYWORD_NAME_WDI_CONTEXT "WDI Context" |
| 112 | #define WEVT_KEYWORD_NAME_WDI_DIAG "WDI Diagnostics" |
| 113 | #define WEVT_KEYWORD_NAME_SQM "SQM (Software Quality Metrics)" |
| 114 | #define WEVT_KEYWORD_NAME_AUDIT_FAILURE "Audit Failure" |
| 115 | #define WEVT_KEYWORD_NAME_AUDIT_SUCCESS "Audit Success" |
| 116 | #define WEVT_KEYWORD_NAME_CORRELATION_HINT "Correlation Hint" |
| 117 | #define WEVT_KEYWORD_NAME_EVENTLOG_CLASSIC "Event Log Classic" |
| 118 | |
| 119 | #define WEVT_PREFIX_LEVEL "Level " // the space at the end is needed |
| 120 | #define WEVT_PREFIX_KEYWORDS "Keywords " // the space at the end is needed |
| 121 | #define WEVT_PREFIX_OPCODE "Opcode " // the space at the end is needed |
| 122 | #define WEVT_PREFIX_TASK "Task " // the space at the end is needed |
| 123 | |
| 124 | #include "windows-events-sources.h" |
| 125 | #include "windows-events-unicode.h" |
| 126 | #include "windows-events-xml.h" |
| 127 | #include "windows-events-providers.h" |
| 128 | #include "windows-events-fields-cache.h" |
| 129 | #include "windows-events-query.h" |
| 130 | |
| 131 | // enable or disable preloading on full-text-search |
| 132 | #define ON_FTS_PRELOAD_MESSAGE 1 |
| 133 | #define ON_FTS_PRELOAD_XML 0 |
| 134 | #define ON_FTS_PRELOAD_EVENT_DATA 1 |
| 135 | |
| 136 | #define WEVT_FUNCTION_DESCRIPTION "Provides full access to Windows Event logs with search, filtering, and analysis capabilities." |
| 137 | #define WEVT_FUNCTION_NAME "windows-events" |
| 138 | |
| 139 | #define WINDOWS_EVENTS_WORKER_THREADS 5 |
| 140 | #define WINDOWS_EVENTS_DEFAULT_TIMEOUT 600 |
| 141 | #define WINDOWS_EVENTS_SCAN_EVERY_USEC (5 * 60 * USEC_PER_SEC) |
| 142 | #define WINDOWS_EVENTS_PROGRESS_EVERY_UT (250 * USEC_PER_MS) |
| 143 | #define FUNCTION_PROGRESS_EVERY_ROWS (2000) |
| 144 | #define FUNCTION_DATA_ONLY_CHECK_EVERY_ROWS (1000) |
| 145 | #define ANCHOR_DELTA_UT (10 * USEC_PER_SEC) |
| 146 | |
| 147 | // run providers release every 5 mins |
| 148 | #define WINDOWS_EVENTS_RELEASE_PROVIDERS_HANDLES_EVERY_UT (5 * 60 * USEC_PER_SEC) |
| 149 | // release idle handles that are older than 5 mins |
| 150 | #define WINDOWS_EVENTS_RELEASE_IDLE_PROVIDER_HANDLES_TIME_UT (5 * 60 * USEC_PER_SEC) |
| 151 | |
| 152 | #define WEVT_FIELD_COMPUTER "Computer" |
| 153 | #define WEVT_FIELD_CHANNEL "Channel" |
| 154 | #define WEVT_FIELD_PROVIDER "Provider" |
| 155 | #define WEVT_FIELD_PROVIDER_GUID "ProviderGUID" |
| 156 | #define WEVT_FIELD_EVENTRECORDID "EventRecordID" |
| 157 | #define WEVT_FIELD_VERSION "Version" |
| 158 | #define WEVT_FIELD_QUALIFIERS "Qualifiers" |
| 159 | #define WEVT_FIELD_EVENTID "EventID" |
| 160 | #define WEVT_FIELD_LEVEL "Level" |
| 161 | #define WEVT_FIELD_KEYWORDS "Keywords" |
| 162 | #define WEVT_FIELD_OPCODE "Opcode" |
| 163 | #define WEVT_FIELD_ACCOUNT "UserAccount" |
| 164 | #define WEVT_FIELD_DOMAIN "UserDomain" |
| 165 | #define WEVT_FIELD_SID "UserSID" |
| 166 | #define WEVT_FIELD_TASK "Task" |
| 167 | #define WEVT_FIELD_PROCESSID "ProcessID" |
| 168 | #define WEVT_FIELD_THREADID "ThreadID" |
| 169 | #define WEVT_FIELD_ACTIVITY_ID "ActivityID" |
| 170 | #define WEVT_FIELD_RELATED_ACTIVITY_ID "RelatedActivityID" |
| 171 | #define WEVT_FIELD_XML "XML" |
| 172 | #define WEVT_FIELD_MESSAGE "Message" |
| 173 | #define WEVT_FIELD_EVENTS_API "EventsAPI" |
| 174 | #define WEVT_FIELD_EVENT_DATA_HIDDEN "__HIDDEN__EVENT__DATA__" |
| 175 | #define WEVT_FIELD_EVENT_MESSAGE_HIDDEN "__HIDDEN__MESSAGE__DATA__" |
| 176 | #define WEVT_FIELD_EVENT_XML_HIDDEN "__HIDDEN__XML__DATA__" |
| 177 | |
| 178 | // functions needed by LQS |
| 179 | |
| 180 | // structures needed by LQS |
| 181 | struct lqs_extension { |
| 182 | wchar_t *query; |
| 183 | |
| 184 | struct { |
| 185 | struct { |
| 186 | size_t completed; |
| 187 | size_t total; |
| 188 | } queries; |
| 189 | |
| 190 | struct { |
| 191 | size_t current_query_total; |
| 192 | size_t completed; |
| 193 | size_t total; |
| 194 | } entries; |
| 195 | |
| 196 | usec_t last_ut; |
| 197 | } progress; |
| 198 | |
| 199 | // struct { |
| 200 | // usec_t start_ut; |
| 201 | // usec_t stop_ut; |
| 202 | // usec_t first_msg_ut; |
| 203 | // |
| 204 | // uint64_t first_msg_seqnum; |
| 205 | // } query_file; |
| 206 | |
| 207 | // struct { |
| 208 | // uint32_t enable_after_samples; |
| 209 | // uint32_t slots; |
| 210 | // uint32_t sampled; |
| 211 | // uint32_t unsampled; |
| 212 | // uint32_t estimated; |
| 213 | // } samples; |
| 214 | |
| 215 | // struct { |
| 216 | // uint32_t enable_after_samples; |
| 217 | // uint32_t every; |
| 218 | // uint32_t skipped; |
| 219 | // uint32_t recalibrate; |
| 220 | // uint32_t sampled; |
| 221 | // uint32_t unsampled; |
| 222 | // uint32_t estimated; |
| 223 | // } samples_per_file; |
| 224 | |
| 225 | // struct { |
| 226 | // usec_t start_ut; |
| 227 | // usec_t end_ut; |
| 228 | // usec_t step_ut; |
| 229 | // uint32_t enable_after_samples; |
| 230 | // uint32_t sampled[SYSTEMD_JOURNAL_SAMPLING_SLOTS]; |
| 231 | // uint32_t unsampled[SYSTEMD_JOURNAL_SAMPLING_SLOTS]; |
| 232 | // } samples_per_time_slot; |
| 233 | |
| 234 | // per file progress info |
| 235 | // size_t cached_count; |
| 236 | |
| 237 | // progress statistics |
| 238 | usec_t matches_setup_ut; |
| 239 | size_t rows_useful; |
| 240 | size_t rows_read; |
| 241 | size_t bytes_read; |
| 242 | size_t files_matched; |
| 243 | size_t file_working; |
| 244 | }; |
| 245 | |
| 246 | // prepare LQS |
| 247 | #define LQS_DEFAULT_SLICE_MODE 0 |
| 248 | #define LQS_FUNCTION_NAME WEVT_FUNCTION_NAME |
| 249 | #define LQS_FUNCTION_DESCRIPTION WEVT_FUNCTION_DESCRIPTION |
| 250 | #define LQS_DEFAULT_ITEMS_PER_QUERY 200 |
| 251 | #define LQS_DEFAULT_ITEMS_SAMPLING 1000000 |
| 252 | #define LQS_SOURCE_TYPE WEVT_SOURCE_TYPE |
| 253 | #define LQS_SOURCE_TYPE_ALL WEVTS_ALL |
| 254 | #define LQS_SOURCE_TYPE_NONE WEVTS_NONE |
| 255 | #define LQS_PARAMETER_SOURCE_NAME "Event Channels" // this is how it is shown to users |
| 256 | #define LQS_FUNCTION_GET_INTERNAL_SOURCE_TYPE(value) WEVT_SOURCE_TYPE_2id_one(value) |
| 257 | #define LQS_FUNCTION_SOURCE_TO_JSON_ARRAY(wb) wevt_sources_to_json_array(wb) |
| 258 | #include "libnetdata/facets/logs_query_status.h" |
| 259 | |
| 260 | #include "windows-events-query-builder.h" // needs the LQS definition, so it has to be last |
| 261 | |
| 262 | #endif //NETDATA_WINDOWS_EVENTS_H |