fluent-plugin-windows-eventlog 0.2.2 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +5 -5
- data/.gitignore +14 -14
- data/CHANGELOG.md +16 -0
- data/Gemfile +4 -4
- data/LICENSE.txt +203 -203
- data/README.md +279 -132
- data/Rakefile +10 -10
- data/appveyor.yml +24 -34
- data/fluent-plugin-winevtlog.gemspec +27 -25
- data/lib/fluent/plugin/in_windows_eventlog.rb +234 -234
- data/lib/fluent/plugin/in_windows_eventlog2.rb +169 -0
- data/lib/fluent/plugin/parser_winevt_xml.rb +34 -0
- data/test/data/eventlog.xml +1 -0
- data/test/generate-windows-event.rb +47 -47
- data/test/helper.rb +35 -32
- data/test/plugin/test_in_windows_eventlog2.rb +182 -0
- data/test/plugin/test_in_winevtlog.rb +48 -48
- data/test/plugin/test_parser_winevt_xml.rb +42 -0
- metadata +41 -4
@@ -1,48 +1,48 @@
|
|
1
|
-
require 'helper'
|
2
|
-
require 'generate-windows-event'
|
3
|
-
|
4
|
-
class WindowsEventLogInputTest < Test::Unit::TestCase
|
5
|
-
|
6
|
-
def setup
|
7
|
-
Fluent::Test.setup
|
8
|
-
end
|
9
|
-
|
10
|
-
CONFIG = config_element("ROOT", "", {"tag" => "fluent.eventlog"}, [
|
11
|
-
config_element("storage", "", {
|
12
|
-
'@type' => 'local',
|
13
|
-
'persistent' => false
|
14
|
-
})
|
15
|
-
])
|
16
|
-
|
17
|
-
def create_driver(conf = CONFIG)
|
18
|
-
Fluent::Test::Driver::Input.new(Fluent::Plugin::WindowsEventLogInput).configure(conf)
|
19
|
-
end
|
20
|
-
|
21
|
-
def test_configure
|
22
|
-
d = create_driver CONFIG
|
23
|
-
assert_equal 'fluent.eventlog', d.instance.tag
|
24
|
-
assert_equal 2, d.instance.read_interval
|
25
|
-
assert_nil d.instance.pos_file
|
26
|
-
assert_equal ['application'], d.instance.channels
|
27
|
-
assert_true d.instance.keys.empty?
|
28
|
-
assert_false d.instance.read_from_head
|
29
|
-
end
|
30
|
-
|
31
|
-
def test_write
|
32
|
-
d = create_driver
|
33
|
-
|
34
|
-
service = Fluent::Plugin::EventService.new
|
35
|
-
|
36
|
-
d.run(expect_emits: 1) do
|
37
|
-
service.run
|
38
|
-
end
|
39
|
-
|
40
|
-
assert(d.events.length >= 1)
|
41
|
-
event = d.events.last
|
42
|
-
record = event.last
|
43
|
-
assert_equal("application", record["channel"])
|
44
|
-
assert_equal("65500", record["event_id"])
|
45
|
-
assert_equal("information", record["event_type"])
|
46
|
-
assert_equal("fluent-plugins", record["source_name"])
|
47
|
-
end
|
48
|
-
end
|
1
|
+
require 'helper'
|
2
|
+
require 'generate-windows-event'
|
3
|
+
|
4
|
+
class WindowsEventLogInputTest < Test::Unit::TestCase
|
5
|
+
|
6
|
+
def setup
|
7
|
+
Fluent::Test.setup
|
8
|
+
end
|
9
|
+
|
10
|
+
CONFIG = config_element("ROOT", "", {"tag" => "fluent.eventlog"}, [
|
11
|
+
config_element("storage", "", {
|
12
|
+
'@type' => 'local',
|
13
|
+
'persistent' => false
|
14
|
+
})
|
15
|
+
])
|
16
|
+
|
17
|
+
def create_driver(conf = CONFIG)
|
18
|
+
Fluent::Test::Driver::Input.new(Fluent::Plugin::WindowsEventLogInput).configure(conf)
|
19
|
+
end
|
20
|
+
|
21
|
+
def test_configure
|
22
|
+
d = create_driver CONFIG
|
23
|
+
assert_equal 'fluent.eventlog', d.instance.tag
|
24
|
+
assert_equal 2, d.instance.read_interval
|
25
|
+
assert_nil d.instance.pos_file
|
26
|
+
assert_equal ['application'], d.instance.channels
|
27
|
+
assert_true d.instance.keys.empty?
|
28
|
+
assert_false d.instance.read_from_head
|
29
|
+
end
|
30
|
+
|
31
|
+
def test_write
|
32
|
+
d = create_driver
|
33
|
+
|
34
|
+
service = Fluent::Plugin::EventService.new
|
35
|
+
|
36
|
+
d.run(expect_emits: 1) do
|
37
|
+
service.run
|
38
|
+
end
|
39
|
+
|
40
|
+
assert(d.events.length >= 1)
|
41
|
+
event = d.events.last
|
42
|
+
record = event.last
|
43
|
+
assert_equal("application", record["channel"])
|
44
|
+
assert_equal("65500", record["event_id"])
|
45
|
+
assert_equal("information", record["event_type"])
|
46
|
+
assert_equal("fluent-plugins", record["source_name"])
|
47
|
+
end
|
48
|
+
end
|
@@ -0,0 +1,42 @@
|
|
1
|
+
require 'helper'
|
2
|
+
require 'generate-windows-event'
|
3
|
+
|
4
|
+
class WinevtXMLparserTest < Test::Unit::TestCase
|
5
|
+
|
6
|
+
def setup
|
7
|
+
Fluent::Test.setup
|
8
|
+
end
|
9
|
+
|
10
|
+
CONFIG = %[]
|
11
|
+
XMLLOG = File.open(File.join(__dir__, "..", "data", "eventlog.xml") )
|
12
|
+
|
13
|
+
def create_driver(conf = CONFIG)
|
14
|
+
Fluent::Test::Driver::Parser.new(Fluent::Plugin::WinevtXMLparser).configure(conf)
|
15
|
+
end
|
16
|
+
|
17
|
+
def test_parse
|
18
|
+
d = create_driver
|
19
|
+
xml = XMLLOG
|
20
|
+
expected = {"ProviderName" => "Microsoft-Windows-Security-Auditing",
|
21
|
+
"ProviderGUID" => "{54849625-5478-4994-A5BA-3E3B0328C30D}",
|
22
|
+
"EventID" => "4624",
|
23
|
+
"Qualifiers" => nil,
|
24
|
+
"Level" => "0",
|
25
|
+
"Task" => "12544",
|
26
|
+
"Opcode" => "0",
|
27
|
+
"Keywords" => "0x8020000000000000",
|
28
|
+
"TimeCreated" => "2019-06-13T09:21:23.345889600Z",
|
29
|
+
"EventRecordID" => "80688",
|
30
|
+
"ActivityID" => "",
|
31
|
+
"RelatedActivityID" => "{587F0743-1F71-0006-5007-7F58711FD501}",
|
32
|
+
"ThreadID" => "24708",
|
33
|
+
"Channel" => "Security",
|
34
|
+
"Computer" => "Fluentd-Developing-Windows",
|
35
|
+
"UserID" => nil,
|
36
|
+
"Version" => "2",
|
37
|
+
"EventData" => []}
|
38
|
+
d.instance.parse(xml) do |time, record|
|
39
|
+
assert_equal(expected, record)
|
40
|
+
end
|
41
|
+
end
|
42
|
+
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-windows-eventlog
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 0.3.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- okahashi117
|
@@ -10,7 +10,7 @@ authors:
|
|
10
10
|
autorequire:
|
11
11
|
bindir: bin
|
12
12
|
cert_chain: []
|
13
|
-
date:
|
13
|
+
date: 2019-07-09 00:00:00.000000000 Z
|
14
14
|
dependencies:
|
15
15
|
- !ruby/object:Gem::Dependency
|
16
16
|
name: bundler
|
@@ -88,7 +88,35 @@ dependencies:
|
|
88
88
|
- - ">="
|
89
89
|
- !ruby/object:Gem::Version
|
90
90
|
version: '0'
|
91
|
-
|
91
|
+
- !ruby/object:Gem::Dependency
|
92
|
+
name: winevt_c
|
93
|
+
requirement: !ruby/object:Gem::Requirement
|
94
|
+
requirements:
|
95
|
+
- - ">="
|
96
|
+
- !ruby/object:Gem::Version
|
97
|
+
version: '0'
|
98
|
+
type: :runtime
|
99
|
+
prerelease: false
|
100
|
+
version_requirements: !ruby/object:Gem::Requirement
|
101
|
+
requirements:
|
102
|
+
- - ">="
|
103
|
+
- !ruby/object:Gem::Version
|
104
|
+
version: '0'
|
105
|
+
- !ruby/object:Gem::Dependency
|
106
|
+
name: nokogiri
|
107
|
+
requirement: !ruby/object:Gem::Requirement
|
108
|
+
requirements:
|
109
|
+
- - "~>"
|
110
|
+
- !ruby/object:Gem::Version
|
111
|
+
version: '1.10'
|
112
|
+
type: :runtime
|
113
|
+
prerelease: false
|
114
|
+
version_requirements: !ruby/object:Gem::Requirement
|
115
|
+
requirements:
|
116
|
+
- - "~>"
|
117
|
+
- !ruby/object:Gem::Version
|
118
|
+
version: '1.10'
|
119
|
+
description: Fluentd Input plugin to read windows event log.
|
92
120
|
email:
|
93
121
|
- naruki_okahashi@jbat.co.jp
|
94
122
|
- cosmo0920.oucc@gmail.com
|
@@ -98,6 +126,7 @@ extensions: []
|
|
98
126
|
extra_rdoc_files: []
|
99
127
|
files:
|
100
128
|
- ".gitignore"
|
129
|
+
- CHANGELOG.md
|
101
130
|
- Gemfile
|
102
131
|
- LICENSE.txt
|
103
132
|
- README.md
|
@@ -105,9 +134,14 @@ files:
|
|
105
134
|
- appveyor.yml
|
106
135
|
- fluent-plugin-winevtlog.gemspec
|
107
136
|
- lib/fluent/plugin/in_windows_eventlog.rb
|
137
|
+
- lib/fluent/plugin/in_windows_eventlog2.rb
|
138
|
+
- lib/fluent/plugin/parser_winevt_xml.rb
|
139
|
+
- test/data/eventlog.xml
|
108
140
|
- test/generate-windows-event.rb
|
109
141
|
- test/helper.rb
|
142
|
+
- test/plugin/test_in_windows_eventlog2.rb
|
110
143
|
- test/plugin/test_in_winevtlog.rb
|
144
|
+
- test/plugin/test_parser_winevt_xml.rb
|
111
145
|
homepage: https://github.com/fluent/fluent-plugin-windows-eventlog
|
112
146
|
licenses:
|
113
147
|
- Apache-2.0
|
@@ -128,11 +162,14 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
128
162
|
version: '0'
|
129
163
|
requirements: []
|
130
164
|
rubyforge_project:
|
131
|
-
rubygems_version: 2.
|
165
|
+
rubygems_version: 2.7.3
|
132
166
|
signing_key:
|
133
167
|
specification_version: 4
|
134
168
|
summary: Fluentd Input plugin to read windows event log.
|
135
169
|
test_files:
|
170
|
+
- test/data/eventlog.xml
|
136
171
|
- test/generate-windows-event.rb
|
137
172
|
- test/helper.rb
|
173
|
+
- test/plugin/test_in_windows_eventlog2.rb
|
138
174
|
- test/plugin/test_in_winevtlog.rb
|
175
|
+
- test/plugin/test_parser_winevt_xml.rb
|