fluent-plugin-windows-eventlog 0.5.2 → 0.7.1.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 359baf1a9205ef362e4504df9408456929e11476b8b7ca8f31b930fa75f67996
-  data.tar.gz: 3022117b4b9650f09e7856cfbb82a39267818bb71b46fb016ca0f71deb26c4d9
+  metadata.gz: c5bfbe6035f27762fffa9e75863aee873ac0873ebd24694ae19733c230cb9170
+  data.tar.gz: 663554158b2d149821ca54701b655392afff19132c453c0be3f534aa1a684898
 SHA512:
-  metadata.gz: c37d3b7a0a0c8b39e889efdda75fd7d22e6227b7a60eb1c47e9f2b459458c3144725a9d68f7e4ad6215315f62ce0829dde6730f7fccc4d37d93b2a47e7e8951f
-  data.tar.gz: b1cad59577bcec5188c0009545d0a89087210abf8b5bc1f946453607ab0b3f8b87aff1dfacbbf066d0d3b61c0505b9ffdde9da3ab788ca9dd2bc53be1ee65f1e
+  metadata.gz: 067ec531a1b265133b924709203d54a45c9641ac982ce0a1b876dc16d4968362c691ac4950bbdb5c38516a3a9bebd0389d46a66c1d1cc1e95715d3c76a783ee6
+  data.tar.gz: '097951b41de440a39b7ca983b93320778e38d15c28bbaa1495aff593637d4b805f4413dedd7e2855ec8b3d89b72c90fd23c354d4e7e34d075af5d0a5ebaeb326'

data/CHANGELOG.md

@@ -1,3 +1,19 @@
+# Release v.0.7.1.rc1 - 2020/06/23
+* in_windows_eventlog2: Depends on nokogiri 1.11 series
+
+# Release v0.7.0 - 2020/05/22
+* in_windows_eventlog2: Support multilingual description
+
+# Release v0.6.0 - 2020/04/15
+* Make fluent-plugin-parser-winevt_xml plugin as optional dependency
+* in_windows_eventlog2: Render Ruby hash object directly by default
+
+# Release v0.5.4 - 2020/04/10
+* Permit using nokogiri 1.11.0
+
+# Release v0.5.3 - 2020/03/17
+* in_windows_eventlog2: Add Qualifiers key handling options
+
 # Release v0.5.2 - 2020/02/28
 * in_windows_eventlog2: Add parameter to read from all channels shortcut
 

data/README.md

@@ -139,8 +139,11 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
       read_existing_events false
       read_interval 2
       tag winevt.raw
-      render_as_xml false       # default is true.
+      render_as_xml false       # default is false.
       rate_limit 200            # default is -1(Winevt::EventLog::Subscribe::RATE_INFINITE).
+      # preserve_qualifiers_on_hash true # default is false.
+      # read_all_channels false # default is false.
+      # description_locale en_US # default is nil. It means that system locale is used for obtaining description.
       <storage>
         @type local             # @type local is the default.
         persistent true         # default is true. Set to false to use in-memory storage.
@@ -149,6 +152,11 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
       </storage>
       <parse>
         @type winevt_xml # @type winevt_xml is the default. winevt_xml and none parsers are supported for now.
+        # When set up it as true, this plugin preserves "Qualifiers" and "EventID" keys.
+        # When set up it as false, this plugin calculates actual "EventID" from "Qualifiers" and removing "Qualifiers".
+        # With the following equation:
+        # (EventID & 0xffff) | (Qualifiers & 0xffff) << 16
+        preserve_qualifiers true
       </parse>
       # <subscribe>
       #   channles application, system
@@ -160,7 +168,7 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
 
 **NOTE:** When `Description` contains error message such as `The message resource is present but the message was not found in the message table.`, eventlog's resource file (.mui) related to error generating event is something wrong. This issue is also occurred in built-in Windows Event Viewer which is the part of Windows management tool.
 
-**NOTE:** When `render_as_xml` as `false`, the dependent winevt_c gem renders Windows EventLog as Ruby Hash object directly. This reduces bottleneck to consume EventLog. Specifying `render_as_xml` as `false` should be faster consuming than `render_as_xml` as `true` case.
+**NOTE:** When `render_as_xml` as `true`, `fluent-plugin-parser-winevt_xml` plugin should be needed to parse XML rendered Windows EventLog string.
 
 **NOTE:** If you encountered CPU spike due to massively huge EventLog channel, `rate_limit` parameter may help you. Currently, this paramter can handle the multiples of 10 or -1(`Winevt::EventLog::Subscribe::RATE_INFINITE`).
 
@@ -177,8 +185,11 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
 |`parse_description`| (option) parse `description` field and set parsed result into the record. `Description` and `EventData` fields are removed|
 |`read_from_head`   | **Deprecated** (option) Start to read the entries from the oldest, not from when fluentd is started. Defaults to `false`.|
 |`read_existing_events` | (option) Read the entries which already exist before fluentd is started. Defaults to `false`.|
+|`render_as_xml` | (option) Render Windows EventLog as XML or Ruby Hash object directly. Defaults to `false`.|
 |`rate_limit`      | (option) Specify rate limit to consume EventLog. Default is `Winevt::EventLog::Subscribe::RATE_INFINITE`.|
+|`preserve_qualifiers_on_hash`      | (option) When set up it as true, this plugin preserves "Qualifiers" and "EventID" keys. When set up it as false, this plugin calculates actual "EventID" from "Qualifiers" and removing "Qualifiers". Default is `false`.|
 |`read_all_channels`| (option) Read from all channels. Default is `false`|
+|`description_locale`| (option) Specify description locale. Default is `nil`. See also: [Supported locales](https://github.com/fluent-plugins-nursery/winevt_c#multilingual-description) |
 |`<subscribe>`          | Setting for subscribe channels. |
 
 ##### subscribe section

data/fluent-plugin-winevtlog.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-windows-eventlog"
-  spec.version       = "0.5.2"
+  spec.version       = "0.7.1.rc1"
   spec.authors       = ["okahashi117", "Hiroshi Hatake", "Masahiro Nakagawa"]
   spec.email         = ["naruki_okahashi@jbat.co.jp", "cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
   spec.summary       = %q{Fluentd Input plugin to read windows event log.}
@@ -20,9 +20,9 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake"
   spec.add_development_dependency "test-unit", "~> 3.2.0"
+  spec.add_development_dependency "nokogiri", [">= 1.11.pre", "< 1.12"]
+  spec.add_development_dependency "fluent-plugin-parser-winevt_xml", ">= 0.1.2"
   spec.add_runtime_dependency "fluentd", [">= 0.14.12", "< 2"]
   spec.add_runtime_dependency "win32-eventlog"
-  spec.add_runtime_dependency "winevt_c", ">= 0.7.1"
-  spec.add_runtime_dependency "nokogiri", "~> 1.10"
-  spec.add_runtime_dependency "fluent-plugin-parser-winevt_xml", ">= 0.1.2"
+  spec.add_runtime_dependency "winevt_c", ">= 0.8.1"
 end

data/lib/fluent/plugin/in_windows_eventlog.rb

@@ -49,6 +49,7 @@ module Fluent::Plugin
     end
 
     def configure(conf)
+      log.warn "in_windows_eventlog is deprecated. It will be removed in the future version."
       super
       @chs = @channels.map {|ch| ch.strip.downcase }.uniq
       if @chs.empty?

data/lib/fluent/plugin/in_windows_eventlog2.rb

@@ -38,9 +38,11 @@ module Fluent::Plugin
     config_param :read_from_head, :bool, default: false, deprecated: "Use `read_existing_events' instead."
     config_param :read_existing_events, :bool, default: false
     config_param :parse_description, :bool, default: false
-    config_param :render_as_xml, :bool, default: true
+    config_param :render_as_xml, :bool, default: false
     config_param :rate_limit, :integer, default: Winevt::EventLog::Subscribe::RATE_INFINITE
+    config_param :preserve_qualifiers_on_hash, :bool, default: false
     config_param :read_all_channels, :bool, default: false
+    config_param :description_locale, :string, default: nil
 
     config_section :subscribe, param_name: :subscribe_configs, required: false, multi: true do
       config_param :channels, :array
@@ -95,12 +97,11 @@ module Fluent::Plugin
       if @keynames.empty?
         @keynames = KEY_MAP.keys
       end
-      @keynames.delete('Qualifiers') unless @render_as_xml
-      @keynames.delete('EventData') if @parse_description
 
       @tag = tag
       @bookmarks_storage = storage_create(usage: "bookmarks")
       @winevt_xml = false
+      @parser = nil
       if @render_as_xml
         @parser = parser_create
         @winevt_xml = @parser.respond_to?(:winevt_xml?) && @parser.winevt_xml?
@@ -112,6 +113,25 @@ module Fluent::Plugin
           alias_method :on_notify, :on_notify_hash
         end
       end
+
+      if @render_as_xml && @preserve_qualifiers_on_hash
+        raise Fluent::ConfigError, "preserve_qualifiers_on_hash must be used with Hash object rendering(render_as_xml as false)."
+      end
+      if !@render_as_xml && !@preserve_qualifiers_on_hash
+        @keynames.delete('Qualifiers')
+      elsif @parser.respond_to?(:preserve_qualifiers?) && !@parser.preserve_qualifiers?
+        @keynames.delete('Qualifiers')
+      end
+      @keynames.delete('EventData') if @parse_description
+
+      locale = Winevt::EventLog::Locale.new
+      if @description_locale && unsupported_locale?(locale, @description_locale)
+        raise Fluent::ConfigError, "'#{@description_locale}' is not supported. Supported locales are: #{locale.each.map{|code, _desc| code}.join(" ")}"
+      end
+    end
+
+    def unsupported_locale?(locale, description_locale)
+      locale.each.select {|c, _d| c.downcase == description_locale.downcase}.empty?
     end
 
     def start
@@ -132,11 +152,15 @@ module Fluent::Plugin
       subscribe.read_existing_events = read_existing_events
       begin
         subscribe.subscribe(ch, "*", bookmark)
+        if !@render_as_xml && @preserve_qualifiers_on_hash
+          subscribe.preserve_qualifiers = @preserve_qualifiers_on_hash
+        end
       rescue Winevt::EventLog::Query::Error => e
         raise Fluent::ConfigError, "Invalid Bookmark XML is loaded. #{e}"
       end
       subscribe.render_as_xml = @render_as_xml
       subscribe.rate_limit = @rate_limit
+      subscribe.locale = @description_locale if @description_locale
       timer_execute("in_windows_eventlog_#{escape_channel(ch)}".to_sym, @read_interval) do
         on_notify(ch, subscribe)
       end

data/test/plugin/test_in_windows_eventlog2.rb

@@ -15,6 +15,14 @@ class WindowsEventLog2InputTest < Test::Unit::TestCase
                                            })
                           ])
 
+  XML_RENDERING_CONFIG = config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                     "render_as_xml" => true}, [
+                                          config_element("storage", "", {
+                                                           '@type' => 'local',
+                                                           'persistent' => false
+                                                         })
+                                        ])
+
   def create_driver(conf = CONFIG)
     Fluent::Test::Driver::Input.new(Fluent::Plugin::WindowsEventLog2Input).configure(conf)
   end
@@ -25,7 +33,7 @@ class WindowsEventLog2InputTest < Test::Unit::TestCase
     assert_equal 2, d.instance.read_interval
     assert_equal [], d.instance.channels
     assert_false d.instance.read_existing_events
-    assert_true d.instance.render_as_xml
+    assert_false d.instance.render_as_xml
   end
 
   sub_test_case "configure" do
@@ -89,6 +97,51 @@ class WindowsEventLog2InputTest < Test::Unit::TestCase
       assert_equal 2, d.instance.instance_variable_get(:@chs).select {|ch, flag| ch == "system"}.size
       assert_equal expected, d.instance.instance_variable_get(:@chs)
     end
+
+    test "invalid combination for preserving qualifiers" do
+      assert_raise(Fluent::ConfigError) do
+        create_driver config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "render_as_xml" => true,
+                                                  "preserve_qualifiers_on_hash" => true,
+                                                 }, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      }),
+                                     ])
+      end
+    end
+
+    test "invalid description locale" do
+      assert_raise(Fluent::ConfigError) do
+        create_driver config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "description_locale" => "ex_EX"
+                                                 }, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      })
+                                     ])
+      end
+    end
+  end
+
+  data("Japanese"                => ["ja_JP", false],
+       "English (United States)" => ["en_US", false],
+       "English (UK)"            => ["en_GB", false],
+       "Dutch"                   => ["nl_NL", false],
+       "French"                  => ["fr_FR", false],
+       "German"                  => ["de_DE", false],
+       "Russian"                 => ["ru_RU", false],
+       "Spanish"                 => ["es_ES", false],
+       "Invalid"                 => ["ex_EX", true],
+      )
+  def test_unsupported_locale_p(data)
+    description_locale, expected = data
+    d = create_driver CONFIG
+    locale = Winevt::EventLog::Locale.new
+    result = d.instance.unsupported_locale?(locale, description_locale)
+    assert_equal expected, result
   end
 
   data("application"        => ["Application", "Application"],
@@ -253,6 +306,37 @@ DESC
       assert_equal("4", record["Level"])
       assert_equal("fluent-plugins", record["ProviderName"])
     end
+
+    def test_write_with_preserving_qualifiers
+      require 'winevt'
+
+      d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                    "render_as_xml" => false,
+                                                    'preserve_qualifiers_on_hash' => true
+                                                   }, [
+                                         config_element("storage", "", {
+                                                          '@type' => 'local',
+                                                          'persistent' => false
+                                                        }),
+                                       ]))
+
+      service = Fluent::Plugin::EventService.new
+      subscribe = Winevt::EventLog::Subscribe.new
+
+      omit "@parser.preserve_qualifiers does not respond" unless subscribe.respond_to?(:preserve_qualifiers?)
+
+      d.run(expect_emits: 1) do
+        service.run
+      end
+
+      assert(d.events.length >= 1)
+      event = d.events.last
+      record = event.last
+
+      assert_true(record.has_key?("Description"))
+      assert_true(record.has_key?("EventData"))
+      assert_true(record.has_key?("Qualifiers"))
+    end
   end
 
   class PersistBookMark < self
@@ -344,7 +428,8 @@ EOS
   end
 
   def test_write_with_none_parser
-    d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog"}, [
+    d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "render_as_xml" => true}, [
                                        config_element("storage", "", {
                                                         '@type' => 'local',
                                                         'persistent' => false
@@ -372,4 +457,34 @@ EOS
     assert_true(record.has_key?("Description"))
     assert_true(record.has_key?("EventData"))
   end
+
+  def test_write_with_winevt_xml_parser_without_qualifiers
+    d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "render_as_xml" => true}, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      }),
+                                       config_element("parse", "", {
+                                                        '@type' => 'winevt_xml',
+                                                        'preserve_qualifiers' => false
+                                                      }),
+                                     ]))
+
+    service = Fluent::Plugin::EventService.new
+
+    omit "@parser.preserve_qualifiers does not respond" unless d.instance.instance_variable_get(:@parser).respond_to?(:preserve_qualifiers?)
+
+    d.run(expect_emits: 1) do
+      service.run
+    end
+
+    assert(d.events.length >= 1)
+    event = d.events.last
+    record = event.last
+
+    assert_true(record.has_key?("Description"))
+    assert_true(record.has_key?("EventData"))
+    assert_false(record.has_key?("Qualifiers"))
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-windows-eventlog
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.7.1.rc1
 platform: ruby
 authors:
 - okahashi117
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-02-28 00:00:00.000000000 Z
+date: 2020-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -55,81 +55,87 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 3.2.0
 - !ruby/object:Gem::Dependency
-  name: fluentd
+  name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.14.12
+        version: 1.11.pre
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2'
-  type: :runtime
+        version: '1.12'
+  type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.14.12
+        version: 1.11.pre
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2'
+        version: '1.12'
 - !ruby/object:Gem::Dependency
-  name: win32-eventlog
+  name: fluent-plugin-parser-winevt_xml
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
+        version: 0.1.2
+  type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.1.2
 - !ruby/object:Gem::Dependency
-  name: winevt_c
+  name: fluentd
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.7.1
+        version: 0.14.12
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.7.1
+        version: 0.14.12
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
 - !ruby/object:Gem::Dependency
-  name: nokogiri
+  name: win32-eventlog
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.10'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.10'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: fluent-plugin-parser-winevt_xml
+  name: winevt_c
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.2
+        version: 0.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.2
+        version: 0.8.1
 description: Fluentd Input plugin to read windows event log.
 email:
 - naruki_okahashi@jbat.co.jp
@@ -171,9 +177,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.7.6.2