-
Notifications
You must be signed in to change notification settings - Fork 207
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix parsing win event log message (#627)
* Fix win event message to insert strings for placeholders * Add test cases for insertion strings * Add comment to insertPlaceholderValues * Update test and test cases for insertPlaceholderValues * Add UserData as a source of insertion strings * Fix typo in comments. Update comments. Rename variable names * Add test cases for EventData/UserData in windowsEventLogRecord * Fix pointer issue in TestUnmarshalWinEvtRecord
- Loading branch information
1 parent
c3b8f8d
commit f19853a
Showing
5 changed files
with
229 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
67 changes: 67 additions & 0 deletions
67
plugins/inputs/windows_event_log/wineventlog/wineventlogrecord_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,67 @@ | ||
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
// SPDX-License-Identifier: MIT | ||
|
||
//go:build windows | ||
// +build windows | ||
|
||
package wineventlog | ||
|
||
import ( | ||
"encoding/xml" | ||
"github.com/stretchr/testify/assert" | ||
"testing" | ||
) | ||
|
||
func TestUnmarshalWinEvtRecord(t *testing.T) { | ||
tests := []struct { | ||
xml string | ||
wEvtRecord windowsEventLogRecord | ||
}{ | ||
{ | ||
xml: ` | ||
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'> | ||
<EventData> | ||
<Data Name='param1'>2022-10-28T22:33:25Z</Data> | ||
<Data Name='param2'>RulesEngine</Data> | ||
<Data Name='param3'>2</Data> | ||
</EventData> | ||
</Event> | ||
`, | ||
wEvtRecord: windowsEventLogRecord{ | ||
EventData: EventData{ | ||
Data: []Datum{ | ||
{"2022-10-28T22:33:25Z"}, | ||
{"RulesEngine"}, | ||
{"2"}, | ||
}, | ||
}, | ||
}, | ||
}, | ||
{ | ||
xml: ` | ||
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'> | ||
<UserData> | ||
<RmSessionEvent xmlns='http://www.microsoft.com/2005/08/Windows/Reliability/RestartManager/'> | ||
<RmSessionId>0</RmSessionId> | ||
<UTCStartTime>2022-10-26T20:24:13.4253261Z</UTCStartTime> | ||
</RmSessionEvent> | ||
</UserData> | ||
</Event> | ||
`, | ||
wEvtRecord: windowsEventLogRecord{ | ||
UserData: UserData{ | ||
Data: []Datum{ | ||
{"0"}, | ||
{"2022-10-26T20:24:13.4253261Z"}, | ||
}, | ||
}, | ||
}, | ||
}, | ||
} | ||
|
||
for _, test := range tests { | ||
var record windowsEventLogRecord | ||
xml.Unmarshal([]byte(test.xml), &record) | ||
assert.Equal(t, test.wEvtRecord, record) | ||
} | ||
} |