Skip to content

Commit 9aed9f1

Browse files
alesnovak-s1alesnovak-s1
authored
EventID Parsing (#1235)
* EventID parsing * Whitespace removed * win32evtlog should be imported only on win32
1 parent 1a589b1 commit 9aed9f1

File tree

3 files changed

+139
-2
lines changed

3 files changed

+139
-2
lines changed

‎scalyr_agent/builtin_monitors/windows_event_log_monitor.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -624,7 +624,9 @@ def GetFormattedEventAsDict(self, render_context, event):
624624
if qualifiers_val[1] != win32evtlog.EvtVarTypeNull:
625625
# then combine the event id with the qualifiers to
626626
# make the full event id.
627-
event_id = win32api.MAKELONG(event_id, qualifiers_val[0])
627+
result["EventIDQualifiers"] = qualifiers_val[0]
628+
result["InstanceID"] = win32api.MAKELONG(event_id, qualifiers_val[0])
629+
628630
result["EventID"] = event_id
629631

630632
metadata = None

‎tests/unit/builtin_monitors/windows_event_log_monitor_tests/Testing.evtx‎

68 KB
Binary file not shown.

‎tests/unit/builtin_monitors/windows_event_log_monitor_tests/windows_event_log_monitor_test.py‎

Lines changed: 136 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
import pytest
2020
import sys
2121
import tempfile
22-
from scalyr_agent.builtin_monitors.windows_event_log_monitor import NewJsonApi
22+
from scalyr_agent.builtin_monitors.windows_event_log_monitor import NewJsonApi, NewApi
2323

2424
if sys.platform == "win32":
2525
import scalyr_agent.builtin_monitors.windows_event_log_monitor
@@ -28,6 +28,7 @@
2828
)
2929
import win32api # pylint: disable=import-error
3030
import win32con # pylint: disable=import-error
31+
import win32evtlog # pylint: disable=import-error
3132

3233
import scalyr_agent.scalyr_logging as scalyr_logging
3334

@@ -43,6 +44,92 @@ def _get_parameter_msg_fixture_path():
4344
"parametermsgfixture.dll",
4445
)
4546

47+
def _get_test_evtx_path():
48+
# Binary event file. Created by saving a selection of events in the Windows EventViewer.
49+
# Contents:
50+
# <Event
51+
# xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
52+
# <System>
53+
# <Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/>
54+
# <EventID Qualifiers='16384'>1033</EventID>
55+
# <Version>0</Version>
56+
# <Level>4</Level>
57+
# <Task>0</Task>
58+
# <Opcode>0</Opcode>
59+
# <Keywords>0x80000000000000</Keywords>
60+
# <TimeCreated SystemTime='2024-01-15T12:53:07.9637286Z'/>
61+
# <EventRecordID>7097</EventRecordID>
62+
# <Correlation/>
63+
# <Execution ProcessID='36380' ThreadID='0'/>
64+
# <Channel>Application</Channel>
65+
# <Computer>S1LT-1515</Computer>
66+
# <Security/>
67+
# </System>
68+
# <EventData>
69+
# <Data>(Security-SPP-Reserved-EnableNotificationMode) </Data>
70+
# <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
71+
# <Data>fe74f55b-0338-41d6-b267-4a201abe7285</Data>
72+
# </EventData>
73+
# </Event>
74+
75+
# <Event
76+
# xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
77+
# <System>
78+
# <Provider Name='MsiInstaller'/>
79+
# <EventID Qualifiers='0'>1040</EventID>
80+
# <Version>0</Version>
81+
# <Level>4</Level>
82+
# <Task>0</Task>
83+
# <Opcode>0</Opcode>
84+
# <Keywords>0x80000000000000</Keywords>
85+
# <TimeCreated SystemTime='2024-01-15T14:23:25.7585180Z'/>
86+
# <EventRecordID>7104</EventRecordID>
87+
# <Correlation/>
88+
# <Execution ProcessID='1436' ThreadID='0'/>
89+
# <Channel>Application</Channel>
90+
# <Computer>S1LT-1515</Computer>
91+
# <Security UserID='S-1-12-1-2752833898-1275485911-2855531437-3679324835'/>
92+
# </System>
93+
# <EventData>
94+
# <Data>C:\Users\ales.novak\AppData\Local\Package Cache\{A8E320AF-B8C7-493C-97D8-6328C1CE721B}v3.10.150.0\dev.msi</Data>
95+
# <Data>34720</Data>
96+
# <Data>(NULL)</Data>
97+
# <Data>(NULL)</Data>
98+
# <Data>(NULL)</Data>
99+
# <Data>(NULL)</Data>
100+
# <Data></Data>
101+
# </EventData>
102+
# </Event>
103+
# <Event
104+
# xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
105+
# <System>
106+
# <Provider Name='Microsoft-Windows-RestartManager' Guid='{0888e5ef-9b98-4695-979d-e92ce4247224}'/>
107+
# <EventID>10000</EventID>
108+
# <Version>0</Version>
109+
# <Level>4</Level>
110+
# <Task>0</Task>
111+
# <Opcode>0</Opcode>
112+
# <Keywords>0x8000000000000000</Keywords>
113+
# <TimeCreated SystemTime='2024-01-15T14:23:25.4974542Z'/>
114+
# <EventRecordID>7105</EventRecordID>
115+
# <Correlation/>
116+
# <Execution ProcessID='1436' ThreadID='29928'/>
117+
# <Channel>Application</Channel>
118+
# <Computer>S1LT-1515</Computer>
119+
# <Security UserID='S-1-12-1-2752833898-1275485911-2855531437-3679324835'/>
120+
# </System>
121+
# <UserData>
122+
# <RmSessionEvent
123+
# xmlns='http://www.microsoft.com/2005/08/Windows/Reliability/RestartManager/'>
124+
# <RmSessionId>0</RmSessionId>
125+
# <UTCStartTime>2024-01-15T14:23:25.4965313Z</UTCStartTime>
126+
# </RmSessionEvent>
127+
# </UserData>
128+
# </Event>
129+
return os.path.join(
130+
os.path.dirname(__file__),
131+
"Testing.evtx"
132+
)
46133

47134
@pytest.mark.windows_platform
48135
class WindowsEventLogMonitorTest(ScalyrTestCase):
@@ -357,6 +444,54 @@ def test_parameter_msg_file_location_lookup(self):
357444
% (channel, provider),
358445
)
359446

447+
@skipIf(sys.platform != "win32", "Skipping tests under non-Windows platform")
448+
def test_format_event_as_dict(self):
449+
query_handle = win32evtlog.EvtQuery(_get_test_evtx_path(), win32evtlog.EvtQueryFilePath)
450+
events = win32evtlog.EvtNext(query_handle, 100)
451+
452+
config = {
453+
"module": "windows_event_log_monitor",
454+
}
455+
logger = scalyr_logging.getLogger(config["module"])
456+
457+
new_api = NewApi(config, logger, None)
458+
459+
render_context = win32evtlog.EvtCreateRenderContext(
460+
win32evtlog.EvtRenderContextSystem
461+
)
462+
463+
vals = new_api.GetFormattedEventAsDict(render_context, events[0])
464+
self.assertEqual(vals["EventID"], 1033)
465+
self.assertEqual(vals["EventIDQualifiers"], 16384)
466+
self.assertEqual(vals["InstanceID"], (16384 << 16) | 1033)
467+
self.assertIn("These policies are being excluded since they are only defined with override-only attribute.", vals["Message"])
468+
self.assertEqual(vals["Level"], "Information")
469+
self.assertEqual(vals["Opcode"], 0)
470+
self.assertEqual(vals["Keywords"], ["Classic"])
471+
self.assertEqual(vals["Channel"], "Application")
472+
self.assertEqual(vals["ProviderName"], "Microsoft-Windows-Security-SPP")
473+
474+
vals = new_api.GetFormattedEventAsDict(render_context, events[1])
475+
self.assertEqual(vals["EventID"], 1040)
476+
self.assertEqual(vals["EventIDQualifiers"], 0)
477+
self.assertEqual(vals["InstanceID"], 1040)
478+
self.assertIn("Beginning a Windows Installer transaction", vals["Message"])
479+
self.assertEqual(vals["Level"], "Information")
480+
self.assertEqual(vals["Opcode"], "Info")
481+
self.assertEqual(vals["Keywords"], ["Classic"])
482+
self.assertEqual(vals["Channel"], "Application")
483+
self.assertEqual(vals["ProviderName"], "MsiInstaller")
484+
485+
vals = new_api.GetFormattedEventAsDict(render_context, events[2])
486+
self.assertEqual(vals["EventID"], 10000)
487+
self.assertNotIn("EventIDQualifiers", vals)
488+
self.assertNotIn("InstanceID", vals)
489+
self.assertIn("Starting session 0", vals["Message"])
490+
self.assertEqual(vals["Level"], "Information")
491+
self.assertEqual(vals["Opcode"], "Info")
492+
self.assertEqual(vals["Keywords"], '0x8000000000000000')
493+
self.assertEqual(vals["Channel"], "Application")
494+
self.assertEqual(vals["ProviderName"], "Microsoft-Windows-RestartManager")
360495

361496
@pytest.mark.windows_platform
362497
class WindowsEventLogMonitorTest2(BaseScalyrLogCaptureTestCase):

0 commit comments

Comments
 (0)