fluent-plugin-windows-eventlog 0.8.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29f3b9ced1cd226756c2c6859e50cc974ec95e42a0efdc4b0e5544d69eac9c63
-  data.tar.gz: 61875762c40f75317704cc62a476dc16d947363c7dca6bf167b8c7a23c86a095
+  metadata.gz: bdf1842ac573845b2a01c853ab4dd7afb349c0e014d5538c24aff33f0c674499
+  data.tar.gz: 92003b55f2e2380b3d9d8ebbc3ea794c018cd75b51100562f932ef7fcd751728
 SHA512:
-  metadata.gz: 1c126f6937f433079ddf703d141ecf73d1c3e1bd82e9fb605726109c20c97ab89f3307438da9fd62c80ef80770a39a884c3800c66874ca9519e680d17c9c9ba9
-  data.tar.gz: f5e9178ed7c1b477977d61d4fe306745f2efb3203bf430a612c96e9a27f1186d9980ef7ea236b679ab05c805bca3426b70d77a41288458747e684eb20009609f
+  metadata.gz: d4f8f6b2198d8a8861b1c25a85a7a553b4757db942c03a8246e36f7d1e9a5d085328668a6b55ac32de6cad0491285d2e3009e49606eee0da03c1d7c2fab0dab8
+  data.tar.gz: 474b65132114f707e358d62984becd02f750f7913b2f248ff21db8ac27c668835a6541fa7f8fd3df5a944e241c255e8bdbd607cc0d143d687222bd0e6412e2f7

data/.github/workflows/unit-test.yml

@@ -0,0 +1,34 @@
+name: Unit Test
+on:
+  - push
+  - pull_request
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.experimental }}
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: [ '2.5', '2.6', '2.7', '3.0' ]
+        os:
+          - windows-latest
+        experimental: [false]
+        include:
+          - ruby: 'head'
+            os: windows-latest
+            experimental: true
+    name: Unit testing with Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v2
+    - uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+    - name: Install
+      run: |
+        ruby --version
+        gem --version
+        gem install bundler rake
+        ridk exec bundle install --jobs 4 --retry 3
+    - name: Unit Test
+      run: |
+        bundle exec rake test

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+# Release v0.8.1 - 2021/09/16
+* in_windows_eventlog2: Add trace logs for debugging
+* in_windows_eventlog2: Support event query parameter on Windows EventLog channel subscriptions
+
 # Release v0.8.0 - 2020/09/16
 * in_windows_eventlog2: Support remoting access
 

data/README.md

@@ -145,20 +145,21 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
       # read_all_channels false # default is false.
       # description_locale en_US # default is nil. It means that system locale is used for obtaining description.
       # refresh_subscription_interval 10m # default is nil. It specifies refresh interval for channel subscriptions.
+      # event_query "Event/System[EventID!=1001]" # default is "*".
       <storage>
         @type local             # @type local is the default.
         persistent true         # default is true. Set to false to use in-memory storage.
-        path ./tmp/storage.json # This is required when persistent is true.
+        path ./tmp/storage.json # This is required when persistent is true. If migrating from eventlog v1 please ensure that you remove the old .pos folder
                                 # Or, please consider using <system> section's `root_dir` parameter.
       </storage>
-      <parse>
-        @type winevt_xml # @type winevt_xml is the default. winevt_xml and none parsers are supported for now.
+      # <parse> # Note: parsing is only available when render_as_xml true
+      #  @type winevt_xml # @type winevt_xml is the default. winevt_xml and none parsers are supported for now.
         # When set up it as true, this plugin preserves "Qualifiers" and "EventID" keys.
         # When set up it as false, this plugin calculates actual "EventID" from "Qualifiers" and removing "Qualifiers".
         # With the following equation:
         # (EventID & 0xffff) | (Qualifiers & 0xffff) << 16
-        preserve_qualifiers true
-      </parse>
+        # preserve_qualifiers true # preserve_qualifiers_on_hash can be used as a setting outside <parse> if render_as_xml is false
+      # </parse>
       # <subscribe>
       #   channles application, system
       #   read_existing_events false # read_existing_events should be applied each of subscribe directive(s)
@@ -181,7 +182,7 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
 
 |name      | description |
 |:-----    |:-----       |
-|`channels`         | (option) No default value just empty array, but 'application' is used as default due to backward compatibility. One or more of {'application', 'system', 'setup', 'security'}. If you want to read 'setup' or 'security' logs, you must launch fluentd with administrator privileges.|
+|`channels`         | (option) No default value just empty array, but 'application' is used as default due to backward compatibility. One or more of {'application', 'system', 'setup', 'security'} and other evtx, which is the brand new Windows XML Event Log (EVTX) format since Windows Vista, formatted channels. Theoritically, `in_windows_ventlog2` may read all of channels except for debug and analytical typed channels. If you want to read 'setup' or 'security' logs or some privileged channels, you must launch fluentd with administrator privileges.|
 |`keys`             | (option) A subset of [keys](#read-keys) to read. Defaults to all keys.|
 |`read_interval`    | (option) Read interval in seconds. 2 seconds as default.|
 |`from_encoding`    | (option) Input character encoding. `nil` as default.|
@@ -196,6 +197,7 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
 |`read_all_channels`| (option) Read from all channels. Default is `false`|
 |`description_locale`| (option) Specify description locale. Default is `nil`. See also: [Supported locales](https://github.com/fluent-plugins-nursery/winevt_c#multilingual-description) |
 |`refresh_subscription_interval`|(option) It specifies refresh interval for channel subscriptions. Default is `nil`.|
+|`event_query`|(option) It specifies query for deny/allow/filter events with XPath 1.0 or structured XML query. Default is `"*"` (retrieving all events).|
 |`<subscribe>`          | Setting for subscribe channels. |
 
 ##### subscribe section

data/fluent-plugin-winevtlog.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-windows-eventlog"
-  spec.version       = "0.8.0"
+  spec.version       = "0.8.1"
   spec.authors       = ["okahashi117", "Hiroshi Hatake", "Masahiro Nakagawa"]
   spec.email         = ["naruki_okahashi@jbat.co.jp", "cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
   spec.summary       = %q{Fluentd Input plugin to read windows event log.}
@@ -19,7 +19,7 @@ Gem::Specification.new do |spec|
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake"
-  spec.add_development_dependency "test-unit", "~> 3.2.0"
+  spec.add_development_dependency "test-unit", "~> 3.4.0"
   spec.add_development_dependency "nokogiri", [">= 1.10", "< 1.12"]
   spec.add_development_dependency "fluent-plugin-parser-winevt_xml", ">= 0.1.2"
   spec.add_runtime_dependency "fluentd", [">= 0.14.12", "< 2"]

data/lib/fluent/plugin/in_windows_eventlog2.rb

@@ -46,6 +46,7 @@ module Fluent::Plugin
     config_param :read_all_channels, :bool, default: false
     config_param :description_locale, :string, default: nil
     config_param :refresh_subscription_interval, :time, default: nil
+    config_param :event_query, :string, default: "*"
 
     config_section :subscribe, param_name: :subscribe_configs, required: false, multi: true do
       config_param :channels, :array
@@ -230,7 +231,7 @@ module Fluent::Plugin
       subscribe = Winevt::EventLog::Subscribe.new
       subscribe.read_existing_events = read_existing_events
       begin
-        subscribe.subscribe(ch, "*", bookmark, remote_session)
+        subscribe.subscribe(ch, event_query, bookmark, remote_session)
         if !@render_as_xml && @preserve_qualifiers_on_hash
           subscribe.preserve_qualifiers = @preserve_qualifiers_on_hash
         end
@@ -245,6 +246,7 @@ module Fluent::Plugin
 
     def subscribe_channels(subscriptions)
       subscriptions.each do |ch, subscribe|
+        log.trace "Subscribing Windows EventLog at #{ch} channel"
         @timers[ch] = timer_execute("in_windows_eventlog_#{escape_channel(ch)}".to_sym, @read_interval) do
           on_notify(ch, subscribe)
         end
@@ -310,6 +312,7 @@ module Fluent::Plugin
         end
         router.emit_stream(@tag, es)
         @bookmarks_storage.put(ch, subscribe.bookmark)
+        log.trace "Collecting Windows EventLog from #{ch} channel. Collected size: #{es.size}"
       rescue Winevt::EventLog::Query::Error => e
         log.warn "Invalid XML data on #{ch}.", error: e
         log.warn_backtrace
@@ -340,6 +343,7 @@ module Fluent::Plugin
         end
         router.emit_stream(@tag, es)
         @bookmarks_storage.put(ch, subscribe.bookmark)
+        log.trace "Collecting Windows EventLog from #{ch} channel. Collected size: #{es.size}"
       rescue Winevt::EventLog::Query::Error => e
         log.warn "Invalid Hash data on #{ch}.", error: e
         log.warn_backtrace

data/test/plugin/test_in_windows_eventlog2.rb

@@ -302,6 +302,33 @@ DESC
     assert_equal("fluent-plugins", record["ProviderName"])
   end
 
+  CONFIG_WITH_QUERY = config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "event_query" => "Event/System[EventID=65500]"}, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      })
+                          ])
+  def test_write_with_event_query
+    d = create_driver(CONFIG_WITH_QUERY)
+
+    service = Fluent::Plugin::EventService.new
+
+    d.run(expect_emits: 1) do
+      service.run
+    end
+
+    assert(d.events.length >= 1)
+    event = d.events.last
+    record = event.last
+
+    assert_equal("Application", record["Channel"])
+    assert_equal("65500", record["EventID"])
+    assert_equal("4", record["Level"])
+    assert_equal("fluent-plugins", record["ProviderName"])
+  end
+
+
   CONFIG_KEYS = config_element("ROOT", "", {
                                  "tag" => "fluent.eventlog",
                                  "keys" => ["EventID", "Level", "Channel", "ProviderName"]
@@ -468,8 +495,9 @@ DESC
         service.run
       end
 
-      assert(d2.events.length == 1) # should be tailing after previous context.
-      event2 = d2.events.last
+      events = d2.events.select {|e| e.last["EventID"] == "65500" }
+      assert(events.length == 1) # should be tailing after previous context.
+      event2 = events.last
       record2 = event2.last
 
       curr_id = record2["EventRecordID"].to_i

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-windows-eventlog
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.1
 platform: ruby
 authors:
 - okahashi117
 - Hiroshi Hatake
 - Masahiro Nakagawa
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-09-16 00:00:00.000000000 Z
+date: 2021-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -46,14 +46,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.2.0
+        version: 3.4.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.2.0
+        version: 3.4.0
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -145,6 +145,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/unit-test.yml"
 - ".gitignore"
 - CHANGELOG.md
 - Gemfile
@@ -166,7 +167,7 @@ homepage: https://github.com/fluent/fluent-plugin-windows-eventlog
 licenses:
 - Apache-2.0
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -181,9 +182,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6.2
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: Fluentd Input plugin to read windows event log.
 test_files: