fluent-plugin-winevtlog 0.0.3 → 0.0.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +62 -1
- data/fluent-plugin-winevtlog.gemspec +1 -1
- data/lib/fluent/plugin/in_winevtlog.rb +11 -7
- metadata +14 -14
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: b4bf063ad3c23a1f8336bce79a9e5e840e2943d8
|
4
|
+
data.tar.gz: 63fee0aa93007cbc2df3e7e0924735aaadcf02e3
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: dd1167b0b58e23a92fc54981ae5edc8a4956fa5a9ae43f87923fd82f46ea89223fa85565aafd8e4560b1867473d05b47a0a06d4d602991ecad064e687404a154
|
7
|
+
data.tar.gz: e26f0bf0c19ea3b9d8d6c2ab3bd46760c380bda4defa19ab3742f81a65025baf55ead1b0548883aa2ce56a02bf67ca69665e26cb48ae5bd22ac18fd47c25223b
|
data/README.md
CHANGED
@@ -1,3 +1,64 @@
|
|
1
|
-
#
|
1
|
+
# fluent-plugin-winevtlog
|
2
2
|
|
3
|
+
## Component
|
4
|
+
|
5
|
+
#### fluentd Input plugin for Windows Event Log
|
6
|
+
|
7
|
+
[Fluentd](http://fluentd.org) plugin to read Windows Event Log.
|
8
|
+
You must use fluentd 'Windows' brach to use me, and it doesn't work on Linux of course.
|
9
|
+
|
10
|
+
## Installation
|
11
|
+
gem install fluent-plugin-winevtlog
|
12
|
+
|
13
|
+
## Configuration
|
14
|
+
#### fluentd Input plugin for Windows Event Log
|
15
|
+
|
16
|
+
<source>
|
17
|
+
type winevtlog
|
18
|
+
channel application,system
|
19
|
+
pos_file c:\temp\mypos
|
20
|
+
read_interval 2
|
21
|
+
tag winevt.raw
|
22
|
+
</source>
|
23
|
+
|
24
|
+
|
25
|
+
#### parameters
|
26
|
+
|
27
|
+
|name | description |
|
28
|
+
|:----- |:----- |
|
29
|
+
|channel | (option) 'applicaion' as default. one or combination of {application, system, setup, security}. If you want to read setup or security, administrator priv is required to launch fluentd. |
|
30
|
+
|pos_file | (option, but higly recommended) a path of position file to save record numbers. |
|
31
|
+
|read_interval | (option) a read interval in second. 2 seconds as default.|
|
32
|
+
|
33
|
+
|
34
|
+
#### read keys
|
35
|
+
This plugin reads follows from Windws Event Log. No customization is allowed currently.
|
36
|
+
|
37
|
+
|key|
|
38
|
+
|:----- |
|
39
|
+
|record_number |
|
40
|
+
|time_generated|
|
41
|
+
|time_written |
|
42
|
+
|event_id |
|
43
|
+
|event_type |
|
44
|
+
|event_category |
|
45
|
+
|source_name |
|
46
|
+
|computer_name |
|
47
|
+
|user |
|
48
|
+
|description |
|
49
|
+
|
50
|
+
|
51
|
+
|
52
|
+
## Etc.
|
53
|
+
'read_from_head' is not supporeted currently.You can read newer records after you start first.
|
54
|
+
No customize to read information keys.
|
55
|
+
|
56
|
+
|
57
|
+
|
58
|
+
|
59
|
+
## Copyright
|
60
|
+
####Copyright
|
61
|
+
Copyright(C) 2014- @okahashi117
|
62
|
+
####License
|
63
|
+
Apache License, Version 2.0
|
3
64
|
|
@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
4
4
|
|
5
5
|
Gem::Specification.new do |spec|
|
6
6
|
spec.name = "fluent-plugin-winevtlog"
|
7
|
-
spec.version = "0.0.
|
7
|
+
spec.version = "0.0.4"
|
8
8
|
spec.authors = ["okahashi117"]
|
9
9
|
spec.email = ["naruki_okahashi@jbat.co.jp"]
|
10
10
|
spec.summary = %q{Input plugin to read windows event log.}
|
@@ -1,9 +1,12 @@
|
|
1
1
|
|
2
2
|
require 'win32/eventlog'
|
3
|
+
require 'fluent/input'
|
4
|
+
require 'fluent/plugin'
|
5
|
+
|
3
6
|
include Win32
|
4
7
|
|
5
8
|
module Fluent
|
6
|
-
class WinEvtLog <
|
9
|
+
class WinEvtLog < Input
|
7
10
|
Fluent::Plugin.register_input('winevtlog', self)
|
8
11
|
|
9
12
|
@@KEY_MAP = {"record_number" => :record_number,
|
@@ -48,8 +51,9 @@ module Fluent
|
|
48
51
|
end
|
49
52
|
|
50
53
|
def start
|
54
|
+
super
|
51
55
|
if @pos_file
|
52
|
-
@pf_file = File.open(@pos_file, File::RDWR|File::CREAT|File::BINARY
|
56
|
+
@pf_file = File.open(@pos_file, File::RDWR|File::CREAT|File::BINARY)
|
53
57
|
@pf_file.sync = true
|
54
58
|
@pf = PositionFile.parse(@pf_file)
|
55
59
|
end
|
@@ -66,7 +70,7 @@ module Fluent
|
|
66
70
|
end
|
67
71
|
|
68
72
|
def setup_wacther(ch, pe)
|
69
|
-
wlw = WindowsLogWatcher.new(ch, pe, &method(:receive_lines))
|
73
|
+
wlw = WindowsLogWatcher.new(@read_interval, ch, pe, &method(:receive_lines))
|
70
74
|
wlw.attach(@loop)
|
71
75
|
wlw
|
72
76
|
end
|
@@ -115,7 +119,7 @@ module Fluent
|
|
115
119
|
h = {"channel" => ch}
|
116
120
|
@keynames.each {|k| h[k]=r.send(@@KEY_MAP[k]).to_s}
|
117
121
|
#h = Hash[@keynames.map {|k| [k, r.send(@@KEY_MAP[k]).to_s]}]
|
118
|
-
|
122
|
+
router.emit(@tag, Engine.now, h)
|
119
123
|
pe[1] +=1
|
120
124
|
end
|
121
125
|
rescue
|
@@ -126,11 +130,11 @@ module Fluent
|
|
126
130
|
|
127
131
|
|
128
132
|
class WindowsLogWatcher
|
129
|
-
def initialize(ch, pe, &receive_lines)
|
133
|
+
def initialize(interval, ch, pe, &receive_lines)
|
130
134
|
@ch = ch
|
131
135
|
@pe = pe || MemoryPositionEntry.new
|
132
136
|
@receive_lines = receive_lines
|
133
|
-
@timer_trigger = TimerWatcher.new(
|
137
|
+
@timer_trigger = TimerWatcher.new(interval, true, &method(:on_notify))
|
134
138
|
end
|
135
139
|
|
136
140
|
attr_reader :ch
|
@@ -182,7 +186,7 @@ module Fluent
|
|
182
186
|
begin
|
183
187
|
numlines = cur_end - old_end
|
184
188
|
|
185
|
-
winlogs = el.read(
|
189
|
+
winlogs = el.read(Win32::EventLog::SEEK_READ | Win32::EventLog::FORWARDS_READ, old_end + 1)
|
186
190
|
@receive_lines.call(@ch, winlogs, pe_sn)
|
187
191
|
|
188
192
|
@pe.update(pe_sn[0], pe_sn[1])
|
metadata
CHANGED
@@ -1,69 +1,69 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-winevtlog
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.0.
|
4
|
+
version: 0.0.4
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- okahashi117
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2016-07-30 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
15
15
|
requirement: !ruby/object:Gem::Requirement
|
16
16
|
requirements:
|
17
|
-
- -
|
17
|
+
- - ">="
|
18
18
|
- !ruby/object:Gem::Version
|
19
19
|
version: '0'
|
20
20
|
type: :development
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
|
-
- -
|
24
|
+
- - ">="
|
25
25
|
- !ruby/object:Gem::Version
|
26
26
|
version: '0'
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: rake
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
30
30
|
requirements:
|
31
|
-
- -
|
31
|
+
- - ">="
|
32
32
|
- !ruby/object:Gem::Version
|
33
33
|
version: '0'
|
34
34
|
type: :development
|
35
35
|
prerelease: false
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
|
-
- -
|
38
|
+
- - ">="
|
39
39
|
- !ruby/object:Gem::Version
|
40
40
|
version: '0'
|
41
41
|
- !ruby/object:Gem::Dependency
|
42
42
|
name: fluentd
|
43
43
|
requirement: !ruby/object:Gem::Requirement
|
44
44
|
requirements:
|
45
|
-
- -
|
45
|
+
- - ">="
|
46
46
|
- !ruby/object:Gem::Version
|
47
47
|
version: '0'
|
48
48
|
type: :runtime
|
49
49
|
prerelease: false
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
51
51
|
requirements:
|
52
|
-
- -
|
52
|
+
- - ">="
|
53
53
|
- !ruby/object:Gem::Version
|
54
54
|
version: '0'
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
56
|
name: win32-eventlog
|
57
57
|
requirement: !ruby/object:Gem::Requirement
|
58
58
|
requirements:
|
59
|
-
- -
|
59
|
+
- - ">="
|
60
60
|
- !ruby/object:Gem::Version
|
61
61
|
version: '0'
|
62
62
|
type: :runtime
|
63
63
|
prerelease: false
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
|
-
- -
|
66
|
+
- - ">="
|
67
67
|
- !ruby/object:Gem::Version
|
68
68
|
version: '0'
|
69
69
|
description: Input plugin to read windwos event log.
|
@@ -73,7 +73,7 @@ executables: []
|
|
73
73
|
extensions: []
|
74
74
|
extra_rdoc_files: []
|
75
75
|
files:
|
76
|
-
- .gitignore
|
76
|
+
- ".gitignore"
|
77
77
|
- Gemfile
|
78
78
|
- LICENSE.txt
|
79
79
|
- README.md
|
@@ -92,17 +92,17 @@ require_paths:
|
|
92
92
|
- lib
|
93
93
|
required_ruby_version: !ruby/object:Gem::Requirement
|
94
94
|
requirements:
|
95
|
-
- -
|
95
|
+
- - ">="
|
96
96
|
- !ruby/object:Gem::Version
|
97
97
|
version: '0'
|
98
98
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
99
99
|
requirements:
|
100
|
-
- -
|
100
|
+
- - ">="
|
101
101
|
- !ruby/object:Gem::Version
|
102
102
|
version: '0'
|
103
103
|
requirements: []
|
104
104
|
rubyforge_project:
|
105
|
-
rubygems_version: 2.
|
105
|
+
rubygems_version: 2.6.6
|
106
106
|
signing_key:
|
107
107
|
specification_version: 4
|
108
108
|
summary: Input plugin to read windows event log.
|