Add integ test for windows event id filtering

generator/test_case_generator.go

@@ -220,6 +220,7 @@ var testTypeToTestConfig = map[string][]testConfig{
 		{testDir: "../../../test/restart"},
 		{testDir: "../../../test/acceptance"},
 		{testDir: "../../../test/feature/windows/event_logs"},
+		{testDir: "../../../test/feature/windows/eventid_logs"},
 		{testDir: "../../../test/log_state/logfile"},
 		{testDir: "../../../test/log_state/windows_event_log"},
 		{

test/feature/windows/event_logs/parameters.yml

@@ -45,30 +45,36 @@ log_validation:
   - log_value: "System information log"
     log_level: "Information"
     log_lines: 1
+    log_channel: "System"
     log_stream: "System"
     log_source: "WindowsEvents"
   - log_value: "System warning log"
     log_level: "Warning"
     log_lines: 1
+    log_channel: "System"
     log_stream: "System"
     log_source: "WindowsEvents"
   - log_value: "System error log"
     log_level: "Error"
     log_lines: 1
+    log_channel: "System"
     log_stream: "System"
     log_source: "WindowsEvents"
   - log_value: "Application information log"
     log_level: "Information"
     log_lines: 1
+    log_channel: "Application"
     log_stream: "Application"
     log_source: "WindowsEvents"
   - log_value: "Application warning log"
     log_level: "Warning"
     log_lines: 1
+    log_channel: "Application"
     log_stream: "Application"
     log_source: "WindowsEvents"
   - log_value: "Application error log"
     log_level: "Error"
     log_lines: 1
+    log_channel: "Application"
     log_stream: "Application"
     log_source: "WindowsEvents"

test/feature/windows/eventid_logs/agent_config.json

@@ -0,0 +1,54 @@
+{
+    "agent": {
+        "debug": true
+    },
+    "logs": {
+      "logs_collected": {
+          "windows_events": {
+            "collect_list": [
+              {
+                "event_name": "System",
+                "event_ids": [
+                 400
+                ],
+                "log_group_name": "{instance_id}",
+                "log_stream_name": "SystemTest400"
+              },
+              {
+                "event_name": "System",
+                "event_levels":[
+                  "ERROR"
+                ],
+                "event_ids": [
+                  700
+                ],
+                "log_group_name": "{instance_id}",
+                "log_stream_name": "SystemTest700"
+              },
+              {
+                "event_name": "Application",
+                "event_levels":[
+                  "WARNING"
+                ],
+                "event_ids": [
+                  89
+                ],
+                "log_group_name": "{instance_id}",
+                "log_stream_name": "Application"
+              }
+            ]
+          },
+          "files": {
+            "collect_list": [
+              {
+                "file_path": "C:/Users/Administrator/AppData/Local/Temp/test1.log",
+                "log_group_name": "{instance_id}",
+                "log_stream_name": "test1.log",
+                "timezone": "UTC"
+              }
+            ]
+          }
+      },
+      "force_flush_interval": 5
+    }
+}

test/feature/windows/eventid_logs/parameters.yml

@@ -0,0 +1,59 @@
+# Receivers that agent needs to tests
+receivers: []
+
+#Test case name
+test_case: "win_feature_event_log"
+validate_type: "feature"
+# Only support metrics/traces/logs, even in this case we validate more than logs,
+# we only make this data_type as a placeholder
+data_type: "logs"
+
+# Number of logs being written
+number_monitored_logs: 1
+# Number of metrics to be sent or number of log lines being written  each minute
+values_per_minute: "2"
+# Number of seconds the agent should run and collect the metrics. In this case, 1 minutes
+agent_collection_period: 60 
+
+cloudwatch_agent_config: "<cloudwatch_agent_config>"
+
+# Logs that the test needs to validate; moreover, the feature validation already has
+# InstanceID as a log group; therefore, does not need to pass it
+# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/validator/validators/feature/feature_validator.go#L108-L111
+# Moreover, the logs are being generated at with the generator 
+# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/internal/common/logs.go#L41-L64
+# and being generated with 2 logs line per minute
+# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/test/feature/mac/parameters.yml#L14
+# and the collection period is 60. If X minutes, the logs line would be X * log lines
+
+log_validation:
+  - log_value: "This is a log line."
+    log_lines: 2
+    log_stream: "test1.log"
+  - log_value: "# 0 - This is a log line."
+    log_lines: 1
+    log_stream: "test1.log"
+  - log_value: "# 1 - This is a log line."
+    log_lines: 1
+    log_stream: "test1.log"
+  - log_value: "System logon-events log"
+    log_level: "Information"
+    log_event_id: 400
+    log_lines: 1
+    log_channel: "System"
+    log_stream: "SystemTest400"
+    log_source: "WindowsEvents"
+  - log_value: "Custom app error log"
+    log_level: "Error"
+    log_event_id: 700
+    log_lines: 1
+    log_channel: "System"
+    log_stream: "SystemTest700"
+    log_source: "WindowsEvents"
+  - log_value: "System buffer error log"
+    log_level: "Warning"
+    log_event_id: 89
+    log_lines: 1
+    log_channel: "Application"
+    log_stream: "Application"
+    log_source: "WindowsEvents"

test/feature/windows/parameters.yml

@@ -254,30 +254,36 @@ log_validation:
   - log_value: "System information log"
     log_level: "Information"
     log_lines: 1
+    log_channel: "System"
     log_stream: "System"
     log_source: "WindowsEvents"
   - log_value: "System warning log"
     log_level: "Warning"
     log_lines: 1
+    log_channel: "System"
     log_stream: "System"
     log_source: "WindowsEvents"
   - log_value: "System error log"
     log_level: "Error"
     log_lines: 1
+    log_channel: "System"
     log_stream: "System"
     log_source: "WindowsEvents"
   - log_value: "Application information log"
     log_level: "Information"
     log_lines: 1
+    log_channel: "Application"
     log_stream: "Application"
     log_source: "WindowsEvents"
   - log_value: "Application warning log"
     log_level: "Warning"
     log_lines: 1
+    log_channel: "Application"
     log_stream: "Application"
     log_source: "WindowsEvents"
   - log_value: "Application error log"
     log_level: "Error"
     log_lines: 1
+    log_channel: "Application"
     log_stream: "Application"
     log_source: "WindowsEvents"

test/log_state/windows_event_log/windows_event_log_windows.go

@@ -65,5 +65,5 @@ type windowsEventWriter struct {
 var _ logs.EntryWriter = (*windowsEventWriter)(nil)
 
 func (w windowsEventWriter) Write(entry string) error {
-	return common.CreateWindowsEvent(w.eventLogName, w.eventLogLevel, entry)
+	return common.CreateWindowsEvent(w.eventLogName, w.eventLogLevel, "1", entry)
 }

util/common/logs.go

@@ -36,7 +36,11 @@ func GenerateWindowsEvents(validationLog []models.LogValidation) error {
 	var multiErr error
 	for _, vLog := range validationLog {
 		if vLog.LogSource == "WindowsEvents" && vLog.LogLevel != "" {
-			err := CreateWindowsEvent(vLog.LogStream, vLog.LogLevel, vLog.LogValue)
+			id := "1"
+			if vLog.LogEventID != "" {
+				id = vLog.LogEventID
+			}
+			err := CreateWindowsEvent(vLog.LogChannel, vLog.LogLevel, id, vLog.LogValue)
 			if err != nil {
 				multiErr = multierr.Append(multiErr, err)
 			}
@@ -45,15 +49,15 @@ func GenerateWindowsEvents(validationLog []models.LogValidation) error {
 	return multiErr
 }
 
-func CreateWindowsEvent(eventLogName string, eventLogLevel string, msg string) error {
-	out, err := exec.Command("eventcreate", "/ID", "1", "/L", eventLogName, "/T", eventLogLevel, "/SO", "MYEVENTSOURCE"+eventLogName, "/D", msg).Output()
+func CreateWindowsEvent(eventLogName string, eventLogLevel string, eventID string, msg string) error {
+	out, err := exec.Command("eventcreate", "/ID", eventID, "/L", eventLogName, "/T", eventLogLevel, "/SO", "MYEVENTSOURCE"+eventLogName, "/D", msg).Output()
 
 	if err != nil {
 		log.Printf("Windows event creation failed: %v; the output is: %s", err, string(out))
 		return err
 	}
 
-	log.Printf("Windows Event is successfully created for logname: %s, loglevel: %s, logmsg: %s", eventLogName, eventLogLevel, msg)
+	log.Printf("Windows Event is successfully created for logname: %s, loglevel: %s, logeventId: %s, logmsg: %s", eventLogName, eventLogLevel, eventID, msg)
 	return nil
 }
 

validator/models/validation_config.go

@@ -69,11 +69,13 @@ type MetricValidation struct {
 }
 
 type LogValidation struct {
-	LogValue  string `yaml:"log_value"`
-	LogLines  int    `yaml:"log_lines"`
-	LogStream string `yaml:"log_stream"`
-	LogLevel  string `yaml:"log_level"`
-	LogSource string `yaml:"log_source"`
+	LogValue         string   `yaml:"log_value"`
+	LogLines         int      `yaml:"log_lines"`
+	LogChannel       string   `yaml:"log_channel"`
+	LogStream        string   `yaml:"log_stream"`
+	LogLevel         string   `yaml:"log_level"`
+	LogEventID       string   `yaml:"log_event_id"`
+	LogSource        string   `yaml:"log_source"`
 }
 
 type MetricDimension struct {

validator/validators/basic/basic_validator.go

@@ -118,7 +118,7 @@ func (s *BasicValidator) CheckData(startTime, endTime time.Time) error {
 		fmt.Println("Traces Metrics are correct!")
 	}
 	for _, logValidation := range logValidations {
-		err := s.ValidateLogs(logValidation.LogStream, logValidation.LogValue, logValidation.LogLevel, logValidation.LogSource, logValidation.LogLines, startTime, endTime)
+		err := s.ValidateLogs(logValidation.LogStream, logValidation.LogValue, logValidation.LogLevel, logValidation.LogSource, logValidation.LogEventID, logValidation.LogLines, startTime, endTime)
 		if err != nil {
 			multiErr = multierr.Append(multiErr, err)
 		}
@@ -186,7 +186,7 @@ func (s *BasicValidator) ValidateTracesMetrics() error {
 	return nil
 }
 
-func (s *BasicValidator) ValidateLogs(logStream, logLine, logLevel, logSource string, expectedMinimumEventCount int, startTime, endTime time.Time) error {
+func (s *BasicValidator) ValidateLogs(logStream, logLine, logLevel, logSource, logEventID string, expectedMinimumEventCount int, startTime, endTime time.Time) error {
 	logGroup := awsservice.GetInstanceId()
 	log.Printf("Start to validate that substring '%s' has at least %d log event(s) within log group %s, log stream %s, between %v and %v", logLine, expectedMinimumEventCount, logGroup, logStream, startTime, endTime)
 	return awsservice.ValidateLogs(
@@ -205,6 +205,9 @@ func (s *BasicValidator) ValidateLogs(logStream, logLine, logLevel, logSource st
 					if logLevel != "" && strings.Contains(message, logLine) && strings.Contains(message, logLevel) {
 						actualEventCount += 1
 					}
+					if logEventID != "" && strings.Contains(message, logLine) && strings.Contains(message, logEventID) {
+						actualEventCount += 1
+					}
 				default:
 					if strings.Contains(message, logLine) {
 						actualEventCount += 1