Beispiel #1
0
func (l *winEventLog) eventHandles(maxRead int) ([]win.EvtHandle, int, error) {
	handles, err := win.EventHandles(l.subscription, maxRead)
	switch err {
	case nil:
		if l.maxRead > maxRead {
			debugf("%s Recovered from RPC_S_INVALID_BOUND error (errno 1734) "+
				"by decreasing batch_read_size to %v", l.logPrefix, maxRead)
		}
		return handles, maxRead, nil
	case win.ERROR_NO_MORE_ITEMS:
		detailf("%s No more events", l.logPrefix)
		return nil, maxRead, nil
	case win.RPC_S_INVALID_BOUND:
		incrementMetric(readErrors, err)
		if err := l.Close(); err != nil {
			return nil, 0, errors.Wrap(err, "failed to recover from RPC_S_INVALID_BOUND")
		}
		if err := l.Open(l.lastRead); err != nil {
			return nil, 0, errors.Wrap(err, "failed to recover from RPC_S_INVALID_BOUND")
		}
		return l.eventHandles(maxRead / 2)
	default:
		incrementMetric(readErrors, err)
		logp.Warn("%s EventHandles returned error %v", l.logPrefix, err)
		return nil, 0, err
	}
}
Beispiel #2
0
func (l *winEventLog) Read() ([]Record, error) {
	handles, err := sys.EventHandles(l.subscription, l.maxRead)
	if err == sys.ERROR_NO_MORE_ITEMS {
		detailf("%s No more events", l.logPrefix)
		return nil, nil
	}
	if err != nil {
		logp.Warn("%s EventHandles returned error %v Errno: %d", l.logPrefix, err)
		return nil, err
	}
	defer func() {
		for _, h := range handles {
			sys.Close(h)
		}
	}()
	detailf("%s EventHandles returned %d handles", l.logPrefix, len(handles))

	var records []Record
	for _, h := range handles {
		e, err := sys.RenderEvent(h, l.systemCtx, 0, l.renderBuf, l.cache.get)
		if err != nil {
			logp.Err("%s Dropping event with rendering error. %v", l.logPrefix, err)
			continue
		}

		r := Record{
			API:           winEventLogAPIName,
			EventLogName:  e.Channel,
			SourceName:    e.ProviderName,
			ComputerName:  e.Computer,
			RecordNumber:  e.RecordID,
			EventID:       uint32(e.EventID),
			Level:         e.Level,
			Category:      e.Task,
			Message:       e.Message,
			MessageErr:    e.MessageErr,
			EventMetadata: l.eventMetadata,
		}

		if e.TimeCreated != nil {
			r.TimeGenerated = *e.TimeCreated
		}

		if e.UserSID != nil {
			r.User = &User{
				Identifier: e.UserSID.Identifier,
				Name:       e.UserSID.Name,
				Domain:     e.UserSID.Domain,
				Type:       e.UserSID.Type.String(),
			}
		}

		records = append(records, r)
	}

	debugf("%s Read() is returning %d records", l.logPrefix, len(records))
	return records, nil
}
Beispiel #3
0
func (l *winEventLog) Read() ([]Record, error) {
	handles, err := win.EventHandles(l.subscription, l.maxRead)
	if err == win.ERROR_NO_MORE_ITEMS {
		detailf("%s No more events", l.logPrefix)
		return nil, nil
	}
	if err != nil {
		logp.Warn("%s EventHandles returned error %v", l.logPrefix, err)
		return nil, err
	}
	defer func() {
		for _, h := range handles {
			win.Close(h)
		}
	}()
	detailf("%s EventHandles returned %d handles", l.logPrefix, len(handles))

	var records []Record
	for _, h := range handles {
		x, err := l.render(h)
		if bufErr, ok := err.(sys.InsufficientBufferError); ok {
			detailf("%s Increasing render buffer size to %d", l.logPrefix,
				bufErr.RequiredSize)
			l.renderBuf = make([]byte, bufErr.RequiredSize)
			x, err = l.render(h)
		}
		if err != nil && x == "" {
			logp.Err("%s Dropping event with rendering error. %v", l.logPrefix, err)
			reportDrop(err)
			continue
		}

		r, err := l.buildRecordFromXML(x, err)
		if err != nil {
			logp.Err("%s Dropping event. %v", l.logPrefix, err)
			reportDrop("unmarshal")
			continue
		}
		records = append(records, r)
	}

	debugf("%s Read() is returning %d records", l.logPrefix, len(records))
	return records, nil
}
Beispiel #4
0
func (l *eventLog) Read() ([]eventlog.LogRecord, error) {
	var events []eventlog.LogRecord
	for {
		handles, err := sys.EventHandles(l.subscription, l.maxRead)
		if err == sys.ERROR_NO_MORE_ITEMS {
			detailf("%s No more events", l.logPrefix)
			break
		}
		if err != nil {
			errno, _ := err.(syscall.Errno)
			logp.Warn("%s Failed to read event handles. %v %v", l.logPrefix,
				err, uint32(errno))
			return nil, err
		}
		detailf("%s EventHandles returned %d events", l.logPrefix, len(handles))

		for _, h := range handles {
			evt, _, err := sys.RenderEvent(h, sys.NullEvtHandle, 0, l.renderBuf, nil)
			if err != nil {
				logp.Err("%s Error rendering event. %v", l.logPrefix, err)
				continue
			}

			events = append(events, eventlog.LogRecord{
				EventLogName:  evt.Channel,
				SourceName:    evt.ProviderName,
				ComputerName:  evt.Computer,
				RecordNumber:  evt.RecordID,
				EventID:       uint32(evt.EventID),
				EventType:     evt.Level, // convert
				EventCategory: evt.Task,
				TimeGenerated: *evt.TimeCreated,
				UserSID:       evt.UserSID,
				Message:       evt.Message,
			})
		}
	}

	return events, nil
}