fluent-plugin-windows-eventlog 0.6.0 → 0.7.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +3 -0
- data/README.md +3 -0
- data/fluent-plugin-winevtlog.gemspec +2 -2
- data/lib/fluent/plugin/in_windows_eventlog2.rb +12 -1
- data/test/plugin/test_in_windows_eventlog2.rb +31 -0
- metadata +4 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: a18857ae590d68bafbdd36879831c94cb3aa59e38c21967f5581e83f1c287a5f
|
4
|
+
data.tar.gz: 98948821d94a57e7073e831976c24fe095f1d35ed98c026dc1f897ba40cac7dd
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: b5a6bfb26c3204a1adafc121389849b65545b0f66ed4888bcd300091028997499e6a73ce112fb47947ba49e5cfe9d60719ace67b09e1b30336c3ddfe9c2e13d3
|
7
|
+
data.tar.gz: 3dba72eec964475e55f5e8133cf51c0aff3d80ca501c468e82995b347639b49eda6b7b9b13cfeb65b8eddf9960afa6e283d7ad7c8a46d86fc5c2e1d33ae28371
|
data/CHANGELOG.md
CHANGED
data/README.md
CHANGED
@@ -142,6 +142,8 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
|
|
142
142
|
render_as_xml false # default is false.
|
143
143
|
rate_limit 200 # default is -1(Winevt::EventLog::Subscribe::RATE_INFINITE).
|
144
144
|
# preserve_qualifiers_on_hash true # default is false.
|
145
|
+
# read_all_channels false # default is false.
|
146
|
+
# description_locale en_US # default is nil. It means that system locale is used for obtaining description.
|
145
147
|
<storage>
|
146
148
|
@type local # @type local is the default.
|
147
149
|
persistent true # default is true. Set to false to use in-memory storage.
|
@@ -187,6 +189,7 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
|
|
187
189
|
|`rate_limit` | (option) Specify rate limit to consume EventLog. Default is `Winevt::EventLog::Subscribe::RATE_INFINITE`.|
|
188
190
|
|`preserve_qualifiers_on_hash` | (option) When set up it as true, this plugin preserves "Qualifiers" and "EventID" keys. When set up it as false, this plugin calculates actual "EventID" from "Qualifiers" and removing "Qualifiers". Default is `false`.|
|
189
191
|
|`read_all_channels`| (option) Read from all channels. Default is `false`|
|
192
|
+
|`description_locale`| (option) Specify description locale. Default is `nil`. See also: [Supported locales](https://github.com/fluent-plugins-nursery/winevt_c#multilingual-description) |
|
190
193
|
|`<subscribe>` | Setting for subscribe channels. |
|
191
194
|
|
192
195
|
##### subscribe section
|
@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
4
4
|
|
5
5
|
Gem::Specification.new do |spec|
|
6
6
|
spec.name = "fluent-plugin-windows-eventlog"
|
7
|
-
spec.version = "0.
|
7
|
+
spec.version = "0.7.0"
|
8
8
|
spec.authors = ["okahashi117", "Hiroshi Hatake", "Masahiro Nakagawa"]
|
9
9
|
spec.email = ["naruki_okahashi@jbat.co.jp", "cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
|
10
10
|
spec.summary = %q{Fluentd Input plugin to read windows event log.}
|
@@ -24,5 +24,5 @@ Gem::Specification.new do |spec|
|
|
24
24
|
spec.add_development_dependency "fluent-plugin-parser-winevt_xml", ">= 0.1.2"
|
25
25
|
spec.add_runtime_dependency "fluentd", [">= 0.14.12", "< 2"]
|
26
26
|
spec.add_runtime_dependency "win32-eventlog"
|
27
|
-
spec.add_runtime_dependency "winevt_c", ">= 0.
|
27
|
+
spec.add_runtime_dependency "winevt_c", ">= 0.8.1"
|
28
28
|
end
|
@@ -42,6 +42,7 @@ module Fluent::Plugin
|
|
42
42
|
config_param :rate_limit, :integer, default: Winevt::EventLog::Subscribe::RATE_INFINITE
|
43
43
|
config_param :preserve_qualifiers_on_hash, :bool, default: false
|
44
44
|
config_param :read_all_channels, :bool, default: false
|
45
|
+
config_param :description_locale, :string, default: nil
|
45
46
|
|
46
47
|
config_section :subscribe, param_name: :subscribe_configs, required: false, multi: true do
|
47
48
|
config_param :channels, :array
|
@@ -122,6 +123,15 @@ module Fluent::Plugin
|
|
122
123
|
@keynames.delete('Qualifiers')
|
123
124
|
end
|
124
125
|
@keynames.delete('EventData') if @parse_description
|
126
|
+
|
127
|
+
locale = Winevt::EventLog::Locale.new
|
128
|
+
if @description_locale && unsupported_locale?(locale, @description_locale)
|
129
|
+
raise Fluent::ConfigError, "'#{@description_locale}' is not supported. Supported locales are: #{locale.each.map{|code, _desc| code}.join(" ")}"
|
130
|
+
end
|
131
|
+
end
|
132
|
+
|
133
|
+
def unsupported_locale?(locale, description_locale)
|
134
|
+
locale.each.select {|c, _d| c.downcase == description_locale.downcase}.empty?
|
125
135
|
end
|
126
136
|
|
127
137
|
def start
|
@@ -142,7 +152,7 @@ module Fluent::Plugin
|
|
142
152
|
subscribe.read_existing_events = read_existing_events
|
143
153
|
begin
|
144
154
|
subscribe.subscribe(ch, "*", bookmark)
|
145
|
-
if !@render_as_xml && @preserve_qualifiers_on_hash
|
155
|
+
if !@render_as_xml && @preserve_qualifiers_on_hash
|
146
156
|
subscribe.preserve_qualifiers = @preserve_qualifiers_on_hash
|
147
157
|
end
|
148
158
|
rescue Winevt::EventLog::Query::Error => e
|
@@ -150,6 +160,7 @@ module Fluent::Plugin
|
|
150
160
|
end
|
151
161
|
subscribe.render_as_xml = @render_as_xml
|
152
162
|
subscribe.rate_limit = @rate_limit
|
163
|
+
subscribe.locale = @description_locale if @description_locale
|
153
164
|
timer_execute("in_windows_eventlog_#{escape_channel(ch)}".to_sym, @read_interval) do
|
154
165
|
on_notify(ch, subscribe)
|
155
166
|
end
|
@@ -111,6 +111,37 @@ class WindowsEventLog2InputTest < Test::Unit::TestCase
|
|
111
111
|
])
|
112
112
|
end
|
113
113
|
end
|
114
|
+
|
115
|
+
test "invalid description locale" do
|
116
|
+
assert_raise(Fluent::ConfigError) do
|
117
|
+
create_driver config_element("ROOT", "", {"tag" => "fluent.eventlog",
|
118
|
+
"description_locale" => "ex_EX"
|
119
|
+
}, [
|
120
|
+
config_element("storage", "", {
|
121
|
+
'@type' => 'local',
|
122
|
+
'persistent' => false
|
123
|
+
})
|
124
|
+
])
|
125
|
+
end
|
126
|
+
end
|
127
|
+
end
|
128
|
+
|
129
|
+
data("Japanese" => ["ja_JP", false],
|
130
|
+
"English (United States)" => ["en_US", false],
|
131
|
+
"English (UK)" => ["en_GB", false],
|
132
|
+
"Dutch" => ["nl_NL", false],
|
133
|
+
"French" => ["fr_FR", false],
|
134
|
+
"German" => ["de_DE", false],
|
135
|
+
"Russian" => ["ru_RU", false],
|
136
|
+
"Spanish" => ["es_ES", false],
|
137
|
+
"Invalid" => ["ex_EX", true],
|
138
|
+
)
|
139
|
+
def test_unsupported_locale_p(data)
|
140
|
+
description_locale, expected = data
|
141
|
+
d = create_driver CONFIG
|
142
|
+
locale = Winevt::EventLog::Locale.new
|
143
|
+
result = d.instance.unsupported_locale?(locale, description_locale)
|
144
|
+
assert_equal expected, result
|
114
145
|
end
|
115
146
|
|
116
147
|
data("application" => ["Application", "Application"],
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-windows-eventlog
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 0.7.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- okahashi117
|
@@ -10,7 +10,7 @@ authors:
|
|
10
10
|
autorequire:
|
11
11
|
bindir: bin
|
12
12
|
cert_chain: []
|
13
|
-
date: 2020-
|
13
|
+
date: 2020-05-22 00:00:00.000000000 Z
|
14
14
|
dependencies:
|
15
15
|
- !ruby/object:Gem::Dependency
|
16
16
|
name: bundler
|
@@ -128,14 +128,14 @@ dependencies:
|
|
128
128
|
requirements:
|
129
129
|
- - ">="
|
130
130
|
- !ruby/object:Gem::Version
|
131
|
-
version: 0.
|
131
|
+
version: 0.8.1
|
132
132
|
type: :runtime
|
133
133
|
prerelease: false
|
134
134
|
version_requirements: !ruby/object:Gem::Requirement
|
135
135
|
requirements:
|
136
136
|
- - ">="
|
137
137
|
- !ruby/object:Gem::Version
|
138
|
-
version: 0.
|
138
|
+
version: 0.8.1
|
139
139
|
description: Fluentd Input plugin to read windows event log.
|
140
140
|
email:
|
141
141
|
- naruki_okahashi@jbat.co.jp
|