Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 21 additions & 8 deletions LogMonitor/src/LogMonitor/EtwMonitor.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@
// Licensed under the MIT license.
//

#include "pch.h"
#include "pch.h" // NOLINT(build/include_subdir)
#include "EtwMonitor.h" // NOLINT(build/include_subdir)

#define MAX_NAME 256

Expand Down Expand Up @@ -77,12 +78,17 @@ EtwMonitor::~EtwMonitor()
{
case ERROR_INVALID_PARAMETER:
logWriter.TraceWarning(
Utility::FormatString(L"Invalid TraceHandle or InstanceName is Null or both. Error: %lu", status).c_str()
Utility::FormatString(
L"Invalid TraceHandle or InstanceName is Null or both. Error: %lu",
status).c_str()
);
break;
case ERROR_ACCESS_DENIED:
logWriter.TraceWarning(
Utility::FormatString(L"Only users running with elevated administrative privileges can control event tracing sessions. Error: %lu", status).c_str()
Utility::FormatString(
L"Only users running with elevated administrative privileges can control"
L" event tracing sessions. Error: %lu",
status).c_str()
);
break;
case ERROR_WMI_INSTANCE_NOT_FOUND:
Expand All @@ -97,12 +103,15 @@ EtwMonitor::~EtwMonitor()
break;
default:
logWriter.TraceWarning(
Utility::FormatString(L"Another issue might be preventing the stop of the event tracing session. Error: %lu", status).c_str()
Utility::FormatString(
L"Another issue might be preventing the stop of the"
L" event tracing session. Error: %lu",
status).c_str()
);
break;
}
}


CloseTrace(m_startTraceHandle);

Expand Down Expand Up @@ -591,10 +600,14 @@ EtwMonitor::StartTraceSession(
logWriter.TraceError(L"You cannot update the level when the provider is not registered.");
break;
case ERROR_NO_SYSTEM_RESOURCES:
logWriter.TraceError(L"Exceeded the number of ETW trace sessions that the provider can enable.");
logWriter.TraceError(
L"Exceeded the number of ETW trace sessions that"
L" the provider can enable.");
break;
case ERROR_ACCESS_DENIED:
logWriter.TraceError(L"Only users with administrative privileges can enable event providers to a cross-process session.");
logWriter.TraceError(
L"Only users with administrative privileges can enable"
L" event providers to a cross-process session.");
break;
default:
logWriter.TraceError(
Expand Down Expand Up @@ -810,7 +823,7 @@ EtwMonitor::PrintEvent(
)
{
DWORD status = ERROR_SUCCESS;

// struct to hold the Etw log entry and later format print
EtwLogEntry logEntry;
EtwLogEntry* pLogEntry = &logEntry;
Expand Down
7 changes: 5 additions & 2 deletions LogMonitor/src/LogMonitor/EtwMonitor.h
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@

#pragma once

#include <string>
#include <vector>

typedef LPTSTR(NTAPI* PIPV6ADDRTOSTRING)(
const IN6_ADDR* Addr,
LPTSTR S
Expand All @@ -30,7 +33,7 @@ struct EtwLogEntry {

class EtwMonitor final
{
public:
public:
EtwMonitor() = delete;

EtwMonitor(
Expand All @@ -43,7 +46,7 @@ class EtwMonitor final

static std::wstring EtwFieldsMapping(_In_ std::wstring etwFields, _In_ void* pLogEntryData);

private:
private:
static constexpr int ETW_MONITOR_THREAD_EXIT_MAX_WAIT_MILLIS = 5 * 1000;

std::vector<ETWProvider> m_providersConfig;
Expand Down
18 changes: 12 additions & 6 deletions LogMonitor/src/LogMonitor/EventMonitor.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@
// Licensed under the MIT license.
//

#include "pch.h"
#include "pch.h" // NOLINT(build/include_subdir)
#include "EventMonitor.h" // NOLINT(build/include_subdir)

using namespace std;


///
/// EventMonitor.cpp
///
Expand Down Expand Up @@ -79,6 +79,7 @@ EventMonitor::~EventMonitor()

if (waitResult != WAIT_OBJECT_0)
{
// Wait failed or timed out
}
}

Expand Down Expand Up @@ -156,7 +157,7 @@ EventMonitor::StartEventMonitor()
// Order stop event first so that stop is prioritized if both events are already signalled (changes
// are available but stop has been called).
//
HANDLE aWaitHandles[eventsCount];
HANDLE aWaitHandles[2];

aWaitHandles[0] = m_stopEvent;

Expand Down Expand Up @@ -193,7 +194,9 @@ EventMonitor::StartEventMonitor()
status = GetLastError();

if (ERROR_EVT_CHANNEL_NOT_FOUND == status)
logWriter.TraceError(L"Failed to subscribe to event log channel. The specified event channel was not found.");
logWriter.TraceError(
L"Failed to subscribe to event log channel."
L" The specified event channel was not found.");
else if (ERROR_EVT_INVALID_QUERY == status)
logWriter.TraceError(
Utility::FormatString(
Expand Down Expand Up @@ -232,7 +235,8 @@ EventMonitor::StartEventMonitor()
{
logWriter.TraceError(
Utility::FormatString(
L"Failed to subscribe to event log channel. Wait operation on event handle failed. Error: %lu.",
L"Failed to subscribe to event log channel."
L" Wait operation on event handle failed. Error: %lu.",
GetLastError()).c_str()
);
}
Expand Down Expand Up @@ -502,7 +506,9 @@ EventMonitor::PrintEvent(
// Extract the variant values for each queried property. If the variant failed to get a valid type
// set a default value.
//
std::wstring providerName = (EvtVarTypeString != variants[EvtSystemProviderName].Type) ? L"" : variants[EvtSystemProviderName].StringVal;
std::wstring providerName =
(EvtVarTypeString != variants[EvtSystemProviderName].Type)
? L"" : variants[EvtSystemProviderName].StringVal;
std::wstring channelName = (EvtVarTypeString != variants[1].Type) ? L"" : variants[1].StringVal;
pLogEntry->eventId = (EvtVarTypeUInt16 != variants[2].Type) ? 0 : variants[2].UInt16Val;
UINT8 level = (EvtVarTypeByte != variants[3].Type) ? 0 : variants[3].ByteVal;
Expand Down
7 changes: 4 additions & 3 deletions LogMonitor/src/LogMonitor/EventMonitor.h
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,11 @@

#pragma once

#include <vector>

class EventMonitor final
{
public:

public:
EventMonitor() = delete;

EventMonitor(
Expand All @@ -23,7 +24,7 @@ class EventMonitor final

static std::wstring EventFieldsMapping(_In_ std::wstring eventField, _In_ void* pLogEntryData);

private:
private:
static constexpr int EVENT_MONITOR_THREAD_EXIT_MAX_WAIT_MILLIS = 5 * 1000;
static constexpr int EVENT_ARRAY_SIZE = 10;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,9 @@
// Licensed under the MIT license.
//

#include "pch.h"
#include <regex>
#include "pch.h" // NOLINT(build/include_subdir)
#include "FileMonitorUtilities.h" // NOLINT(build/include_subdir)
#include <regex> // NOLINT(build/include_order)

/**
* Wrapper around Create Event API
Expand Down
47 changes: 23 additions & 24 deletions LogMonitor/src/LogMonitor/FileMonitor/FileMonitorUtilities.h
Original file line number Diff line number Diff line change
Expand Up @@ -7,36 +7,35 @@

class FileMonitorUtilities final
{
public:
public:
static HANDLE CreateFileMonitorEvent(
_In_ BOOL bManualReset,
_In_ BOOL bInitialState);

static HANDLE CreateFileMonitorEvent(
_In_ BOOL bManualReset,
_In_ BOOL bInitialState);
static HANDLE GetLogDirHandle(
_In_ std::wstring logDirectory,
_In_ HANDLE stopEvent,
_In_ std::double_t waitInSeconds);

static HANDLE GetLogDirHandle(
_In_ std::wstring logDirectory,
_In_ HANDLE stopEvent,
_In_ std::double_t waitInSeconds);
static void ParseDirectoryValue(_Inout_ std::wstring &directory);

static void ParseDirectoryValue(_Inout_ std::wstring &directory);
static bool IsValidSourceFile(_In_ std::wstring directory, bool includeSubdirectories);

static bool IsValidSourceFile(_In_ std::wstring directory, bool includeSubdirectories);
static bool CheckIsRootFolder(_In_ std::wstring dirPath);

static bool CheckIsRootFolder(_In_ std::wstring dirPath);
private:
static HANDLE _RetryOpenDirectoryWithInterval(
std::wstring logDirectory,
std::double_t waitInSeconds,
HANDLE stopEvent,
HANDLE timerEvent);

private:
static HANDLE _RetryOpenDirectoryWithInterval(
std::wstring logDirectory,
std::double_t waitInSeconds,
HANDLE stopEvent,
HANDLE timerEvent);
static bool _IsFileErrorStatus(DWORD status);

static bool _IsFileErrorStatus(DWORD status);
static std::wstring _GetWaitLogMessage(
std::wstring logDirectory,
std::double_t waitInSeconds);

static std::wstring _GetWaitLogMessage(
std::wstring logDirectory,
std::double_t waitInSeconds);

static std::wstring _GetParentDir(
std::wstring dirPath);
static std::wstring _GetParentDir(
std::wstring dirPath);
};
5 changes: 3 additions & 2 deletions LogMonitor/src/LogMonitor/JsonFileParser.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,9 @@
// Licensed under the MIT license.
//

#include "pch.h"
#include <regex>
#include "pch.h" // NOLINT(build/include_subdir)
#include "Parser/JsonFileParser.h" // NOLINT(build/include_subdir)
#include <regex> // NOLINT(build/include_order)

/// JsonFileParser.cpp
///
Expand Down
18 changes: 10 additions & 8 deletions LogMonitor/src/LogMonitor/JsonProcessor.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@
// Licensed under the MIT license.
//

#include "pch.h"
#include "pch.h" // NOLINT(build/include_subdir)
#include "JsonProcessor.h" // NOLINT(build/include_subdir)
#include <algorithm>
#include <memory>
#include <string>
#include <utility>
#include <vector>
#include <algorithm> // NOLINT(build/include_order)
#include <memory> // NOLINT(build/include_order)
#include <string> // NOLINT(build/include_order)
#include <utility> // NOLINT(build/include_order)
#include <vector> // NOLINT(build/include_order)

#ifdef _WIN32
#include <string.h>
Expand Down Expand Up @@ -226,7 +226,8 @@ bool handleFileLog(
if (!FileMonitorUtilities::IsValidSourceFile(directoryW, includeSubdirs)) {
logWriter.TraceError(
Utility::FormatString(
L"Invalid File source: root directory cannot be monitored with includeSubdirectories=true. Directory: %s",
L"Invalid File source: root directory cannot be monitored with"
L" includeSubdirectories=true. Directory: %s",
directoryW.c_str()
).c_str()
);
Expand Down Expand Up @@ -319,7 +320,8 @@ bool handleETWLog(
if (!etwProvider.StringToLevel(Utility::StringToWString(level))) {
logWriter.TraceWarning(
Utility::FormatString(
L"Error parsing configuration file. '%S' isn't a valid log level. Setting 'Error' level as default",
L"Error parsing configuration file. '%S' isn't a valid log level."
L" Setting 'Error' level as default",
level.c_str()
).c_str()
);
Expand Down
18 changes: 11 additions & 7 deletions LogMonitor/src/LogMonitor/LogFileMonitor.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,9 @@
// Licensed under the MIT license.
//

#include "pch.h"
#include <regex>
#include "pch.h" // NOLINT(build/include_subdir)
#include "LogFileMonitor.h" // NOLINT(build/include_subdir)
#include <regex> // NOLINT(build/include_order)

using namespace std;

Expand Down Expand Up @@ -346,7 +347,7 @@ LogFileMonitor::StartLogFileMonitor()
{
m_readLogFilesFromStart = true;
}

m_logDirHandle = logDirHandle;

//
Expand Down Expand Up @@ -496,7 +497,8 @@ LogFileMonitor::StartLogFileMonitor()
status = GetLastError();
logWriter.TraceError(
Utility::FormatString(
L"Failed to monitor log directory changes. Wait operation failed. Log directory: %ws, Error: %d",
L"Failed to monitor log directory changes."
L" Wait operation failed. Log directory: %ws, Error: %d",
m_logDirectory.c_str(),
status
).c_str()
Expand Down Expand Up @@ -786,7 +788,8 @@ LogFileMonitor::LogFilesChangeHandlerStatic(
{
logWriter.TraceError(
Utility::FormatString(
L"Failed to monitor log directory changes. Log files in a directory %s will not be monitored. Error: %lu",
L"Failed to monitor log directory changes."
L" Log files in a directory %s will not be monitored. Error: %lu",
pThis->m_logDirectory.c_str(),
status
).c_str()
Expand Down Expand Up @@ -860,7 +863,7 @@ LogFileMonitor::LogFilesChangeHandler()
if (!SetWaitableTimer(timerEvent, &liDueTime, 0, NULL, NULL, 0))
{
status = GetLastError();

logWriter.TraceError(
Utility::FormatString(
L"Failed to set timer object to monitor log file changes in directory %s. Error: %lu",
Expand Down Expand Up @@ -1014,7 +1017,8 @@ LogFileMonitor::LogFilesChangeHandler()

logWriter.TraceError(
Utility::FormatString(
L"Failed to wait on directory change notification events to monitor log file changes in directory %s. Error: %lu",
L"Failed to wait on directory change notification events"
L" to monitor log file changes in directory %s. Error: %lu",
m_logDirectory.c_str(),
status
).c_str()
Expand Down
Loading
Loading