fluent-plugin-windows-eventlog 0.9.1 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbb3671770acb68849fee334459ef93b64e0e921a5addf3fbe209c7eba3fb928
-  data.tar.gz: 33e0170f55759869b70cf7691e6deec1208cbb38087aa619c1ea8de01750e2ee
+  metadata.gz: aee5a6fff0b05599c781dbb19b43ffd9487bb03a74ba69bbef1f0d20ff8eb0f1
+  data.tar.gz: e9176154815c7973a8ef90b4f5bf57f9be17ee5c8f1d5656d2247bc82b887b49
 SHA512:
-  metadata.gz: 921f6ac048e3d1e29029cd2022777a74d50e356ccd434ade597e668b464899381feb1b6c09b5e3593c042d16c4b5491c13ae01e6fc8ed85685bb186510fb2d09
-  data.tar.gz: a2d34b7fe8757a176171268d8280b33b21ec7f560346d5ab9fe06e0715672d37f3deee3c5db8378e3af8a629465d42027d248c7d2ddd6e9fd9589647b1352697
+  metadata.gz: accd4776c795d420558a6972199a05ac2ffe6e85851ed4c1b0fc4ece8d41e63c68f7be77805f9c606cb552799597c48ba45d3d16f7d4a03b583fb523afe67086
+  data.tar.gz: fed33969e72197fb43b6ca016c0d9cc98f993c767c757143f089f9605c3c311b1546aebb51dc8c4f22b28697333cb0cd1a9d758d233543a85d217afa536c1df7

data/.github/dependabot.yml

@@ -3,4 +3,21 @@ updates:
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
-      interval: 'weekly'
+      interval: 'monthly'
+    groups:
+      # PR: "Security update [package] from [old] to [new]"
+      # This PR should be merged in hurry
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - '*'
+
+      # PR: "Bump [package] from [old] to [new]"
+      # No need to be merged this PR in hurry. It is enough to merge
+      # once in a month.
+      monthly-updates:
+        applies-to: version-updates
+        patterns:
+          - '*'
+    # Allow to create PR both of security and normal updates.
+    open-pull-requests-limit: 1

data/.github/workflows/unit-test.yml

@@ -4,32 +4,34 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+  schedule:
+    - cron: '0 0 1 * *'
 jobs:
+  ruby-versions:
+    uses: ruby/actions/.github/workflows/ruby_versions.yml@master
+    with:
+      engine: cruby
+      min_version: 2.7
   test:
+    needs: ruby-versions
     runs-on: ${{ matrix.os }}
-    continue-on-error: ${{ matrix.experimental }}
+    continue-on-error: ${{ matrix.ruby == 'head' }}
     strategy:
       fail-fast: false
       matrix:
-        ruby: [ '3.4', '3.3', '3.2', '3.1', '3.0', '2.7' ]
+        ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
         os:
           - windows-latest
-        experimental: [false]
-        include:
-          - ruby: 'head'
-            os: windows-latest
-            experimental: true
     name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@v1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ matrix.ruby }}
     - name: Install
       run: |
         ruby --version
         gem --version
-        gem install bundler rake
         ridk exec bundle install --jobs 4 --retry 3
     - name: Unit Test
       run: |

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+# Release v0.9.3 - 2026/09/07
+
+* in_windows_eventlog2: fix key handling in parse_desc (#135)
+
+# Release v0.9.2 - 2025/11/21
+
+* in_windows_eventlog2: remove unexpected spaces in parsing description (#121)
+
 # Release v0.9.1 - 2024/02/17
 
 * Relax required Nokogiri version (#117)

data/fluent-plugin-winevtlog.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-windows-eventlog"
-  spec.version       = "0.9.1"
+  spec.version       = "0.9.3"
   spec.authors       = ["okahashi117", "Hiroshi Hatake", "Masahiro Nakagawa"]
   spec.email         = ["naruki_okahashi@jbat.co.jp", "cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
   spec.summary       = %q{Fluentd Input plugin to read windows event log.}

data/lib/fluent/plugin/in_windows_eventlog2.rb

@@ -39,6 +39,7 @@ module Fluent::Plugin
                "Version"           => ["Version",               :string],
                "Description"       => ["Description",           :string],
                "EventData"         => ["EventData",             :array]}
+    RESERVED_RECORD_KEYS = (KEY_MAP.keys + ["DescriptionTitle"]).freeze
 
     config_param :tag, :string
     config_param :read_interval, :time, default: 2
@@ -412,30 +413,34 @@ module Fluent::Plugin
         parent_key = nil
         elem.split(RECORD_DELIMITER).each { |r|
           key, value = if r.index(FIELD_DELIMITER)
-                         r.split(FIELD_DELIMITER)
+                         r.split(FIELD_DELIMITER, -1)
                        else
-                         r.split(NONE_FIELD_DELIMITER)
+                         r.split(NONE_FIELD_DELIMITER, -1)
                        end
-          key = "" if key.nil?
-          key.chop!  # remove ':' from key
+          key = +"" if key.nil?
+          key.sub!(/:\s*\z/, '')  # remove ':' from key
+          k = parent_key.nil? ? to_key(key) : "#{parent_key}#{@description_key_delimiter}#{to_key(key)}"
+          taken = record.key?(k) || RESERVED_RECORD_KEYS.include?(k)
           if value.nil?
-            parent_key = to_key(key)
+            unless key.empty?
+              previous_key = taken ? nil : k
+              parent_key = to_key(key)
+            end
           else
             # parsed value sometimes contain unexpected "\t". So remove it.
             value.strip!
             # merge empty key values into the previous non-empty key record.
+            # XXX: This is for empty privileges record key.
+            # We should investigate whether an another case exists or not.
             if key.empty?
-              record[previous_key] = [record[previous_key], value].flatten.reject {|e| e.nil?}
-            elsif parent_key.nil?
-              record[to_key(key)] = value
+              record[previous_key] = [record[previous_key], value].flatten.reject {|e| e.nil?} if previous_key
+            elsif taken
+              previous_key = nil
             else
-              k = "#{parent_key}#{@description_key_delimiter}#{to_key(key)}"
               record[k] = value
+              previous_key = k
             end
           end
-          # XXX: This is for empty privileges record key.
-          # We should investigate whether an another case exists or not.
-          previous_key = to_key(key) unless key.empty?
         }
       }
     end

data/test/data/eventid_4697

@@ -0,0 +1,14 @@
+A service was installed in the system.
+
+Subject:
+	Security ID:		SYSTEM
+	Account Name:		824ZWL3$
+	Account Domain:		WORKGROUP
+	Logon ID:		0x3E7
+
+Service Information:
+	Service Name: 		WpnUserService_a46b7
+	Service File Name:	C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
+	Service Type: 		0xE0
+	Service Start Type:	2
+	Service Account: 	LocalSystem

data/test/plugin/test_in_windows_eventlog2.rb

@@ -268,6 +268,177 @@ DESC
     assert_equal(expected, h)
   end
 
+  def test_parse_desc_keeps_event_metadata
+    d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "parse_description" => true,
+                                                  "downcase_description_keys" => false
+                                                  }, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      }),
+                                     ]))
+    desc = [
+      "Creating Scriptblock text (1 of 1):",
+      "",
+      "Channel:\t\tSecurity",
+      "\tEventID:\t\t4624",
+      "\tComputer:\t\tDC01",
+    ].join("\r\n")
+    h = {"Channel"     => "Microsoft-Windows-PowerShell/Operational",
+         "EventID"     => "4104",
+         "Computer"    => "DESKTOP-FLUENTTEST",
+         "Description" => desc}
+    expected = {"Channel"          => "Microsoft-Windows-PowerShell/Operational",
+                "EventID"          => "4104",
+                "Computer"         => "DESKTOP-FLUENTTEST",
+                "DescriptionTitle" => "Creating Scriptblock text (1 of 1):"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_keeps_the_first_value_of_a_duplicated_key
+    d = create_driver
+    desc = [
+      "Special privileges assigned to new logon.",
+      "",
+      "Subject:",
+      "\tAccount Name:\t\tAdministrator",
+      "",
+      "Subject:",
+      "\tAccount Name:\t\tSYSTEM",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle"     => "Special privileges assigned to new logon.",
+                "subject.account_name" => "Administrator"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_does_not_merge_a_continuation_line_into_a_refused_key
+    d = create_driver
+    desc = [
+      "Special privileges assigned to new logon.",
+      "",
+      "Privileges:\t\tSeTcbPrivilege",
+      "",
+      "Privileges:\t\tSeDebugPrivilege",
+      "\t\tSeBackupPrivilege",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle" => "Special privileges assigned to new logon.",
+                "privileges"       => "SeTcbPrivilege"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_does_not_merge_a_continuation_line_into_an_existing_key
+    d = create_driver
+    desc = [
+      "Special privileges assigned to new logon.",
+      "",
+      "Privileges:\t\tSeTcbPrivilege",
+      "",
+      "Privileges:",
+      "\t\tSeDebugPrivilege",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle" => "Special privileges assigned to new logon.",
+                "privileges"       => "SeTcbPrivilege"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_keeps_event_metadata_reached_through_a_continuation_line
+    d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "parse_description" => true,
+                                                  "downcase_description_keys" => false
+                                                  }, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      }),
+                                     ]))
+    desc = [
+      "Creating Scriptblock text (1 of 1):",
+      "",
+      "Channel:",
+      "\t\t\tspoofed",
+    ].join("\r\n")
+    h = {"Channel"     => "Microsoft-Windows-PowerShell/Operational",
+         "Description" => desc}
+    expected = {"Channel"          => "Microsoft-Windows-PowerShell/Operational",
+                "DescriptionTitle" => "Creating Scriptblock text (1 of 1):"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_with_empty_field_value
+    d = create_driver
+    desc = [
+      "A service was installed in the system.",
+      "",
+      "Subject:",
+      "\tAccount Domain:\t\t",
+      "\tLogon ID:\t\t0x3E7",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle"       => "A service was installed in the system.",
+                "subject.account_domain" => "",
+                "subject.logon_id"       => "0x3E7"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_with_an_empty_record_in_a_group
+    d = create_driver
+    desc = [
+      "A service was installed in the system.",
+      "",
+      "Subject:",
+      "\t",
+      "\tLogon ID:\t\t0x3E7",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle" => "A service was installed in the system.",
+                "subject.logon_id" => "0x3E7"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_with_empty_field_value_after_a_single_tab
+    d = create_driver
+    desc = [
+      "A service was installed in the system.",
+      "",
+      "Subject:",
+      "\tService File Name:\t",
+      "\tLogon ID:\t\t0x3E7",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle"          => "A service was installed in the system.",
+                "subject.service_file_name" => "",
+                "subject.logon_id"          => "0x3E7"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_merges_a_continuation_line_into_the_nested_key
+    d = create_driver
+    desc = [
+      "Special privileges assigned to new logon.",
+      "",
+      "Subject:",
+      "\tAccount Name:\t\tAdministrator",
+      "\t\tsecond-value",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle"     => "Special privileges assigned to new logon.",
+                "subject.account_name" => ["Administrator", "second-value"]}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
   def test_parse_privileges_description
     d = create_driver
     desc = ["Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-X-Y-ZZ\r\n\t",
@@ -325,6 +496,27 @@ DESC
     assert_equal(expected, h)
   end
 
+  test "A service was installed in the system." do
+    d = create_driver
+    desc = nil
+    File.open('./test/data/eventid_4697', 'r') do |f|
+      desc = f.read.gsub(/\R/, "\r\n")
+    end
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle"                       => "A service was installed in the system.",
+                "service_information.service_account"    => "LocalSystem",
+                "service_information.service_file_name"  => "C:\\WINDOWS\\system32\\svchost.exe -k UnistackSvcGroup",
+                "service_information.service_name"       => "WpnUserService_a46b7",
+                "service_information.service_start_type" => "2",
+                "service_information.service_type"       => "0xE0",
+                "subject.account_domain" => "WORKGROUP",
+                "subject.account_name"   => "824ZWL3$",
+                "subject.logon_id"       => "0x3E7",
+                "subject.security_id"    => "SYSTEM"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
   def test_write
     d = create_driver XML_RENDERING_CONFIG
 

metadata

@@ -1,16 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-windows-eventlog
 version: !ruby/object:Gem::Version
-  version: 0.9.1
+  version: 0.9.3
 platform: ruby
 authors:
 - okahashi117
 - Hiroshi Hatake
 - Masahiro Nakagawa
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-18 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -152,6 +151,7 @@ files:
 - lib/fluent/plugin/bookmark_sax_parser.rb
 - lib/fluent/plugin/in_windows_eventlog.rb
 - lib/fluent/plugin/in_windows_eventlog2.rb
+- test/data/eventid_4697
 - test/data/eventid_6416
 - test/generate-windows-event.rb
 - test/helper.rb
@@ -162,7 +162,6 @@ homepage: https://github.com/fluent/fluent-plugin-windows-eventlog
 licenses:
 - Apache-2.0
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -177,11 +176,11 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 4.0.18
 specification_version: 4
 summary: Fluentd Input plugin to read windows event log.
 test_files:
+- test/data/eventid_4697
 - test/data/eventid_6416
 - test/generate-windows-event.rb
 - test/helper.rb