winlogbeat/sys/wineventlog: extend testing and fix bugs #30942

efd6 · 2022-03-22T05:54:14Z

What does this PR do?

This fixes a couple of bug identified in #30621 and extends the test fixture to allow addition of further test cases.

This fixes failures in event handling on Windows 2022 where parts of
events available from the Windows API are not reflected in the events recovered by winlogbeat.

There is unfortunately quite a lot of movement in this change due to the
need to satisfy linter requirements. Beyond those changes, the substantive
changes here are:

Addition of new testing infrastructure to allow addition of evtx files
and comparison with there expected XML renderings, and adding some test
cases.
Fixing a buffer length parameter in the call to _EvtFormatMessage in
evtFormatMessage that was the result of a lack of clarity in the API
documentation for that syscall.
Fixing a var shadowing decl of the publisher handle EvtHandle in
FormatEventString.
Providing a call back for the legacy (non-experimental) API through
wineventlog.Message to allow it to obtain the event message in the case
that the RenderingInfo element is not available via the Windows API.
Ensure that keyword, opcode and level are obtained by the non-experimental
API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML.
This change also required making winevent.Event.OpcodeRaw a pointer to
allow an absent System>Opcode element to be distinquished from the zero,
but present element.

The change also enables testing on Windows 2022.

Why is it important?

The bugs look to have caused CI failure when adding Windows2022 to the build matrix #30622.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
~~- [ ] I have made corresponding changes to the documentation~~
~~- [ ] I have made corresponding change to the default configuration files~~
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

[ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

elasticmachine · 2022-03-22T05:54:16Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

elasticmachine · 2022-03-22T06:16:03Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-03-30T05:54:53.556+0000
Duration: 76 min 36 sec

Test stats 🧪

Test	Results
Failed	0
Passed	22268
Skipped	1937
Total	24205

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

andrewkroh · 2022-03-22T21:01:37Z

I pushed in a change to see how the tests react with Windows 2022.

efd6 · 2022-03-22T21:24:49Z

[](https://beats-ci.elastic.co/blue/organizations/jenkins/Beats%2Fbeats/detail/PR-30942/6/pipeline#step-5772-log-25)[](https://beats-ci.elastic.co/blue/organizations/jenkins/Beats%2Fbeats/detail/PR-30942/6/pipeline#step-5772-log-26)[2022-03-22T21:17:16.590Z] winlogbeat/sys/wineventlog/format_message.go:26:2: import of package `github.com/pkg/errors` is blocked because the module is in the blocked modules list. `errors` and `fmt` are recommended modules. This package is deprecated, use `fmt.Errorf` with `%!w(MISSING)` instead. (gomodguard)
[2022-03-22T21:17:16.590Z] 	"github.com/pkg/errors"
[2022-03-22T21:17:16.590Z] 	^

🤣

I'll fix this.

Note: funny that the linter gets the format string wrong use `fmt.Errorf` with `%!w(MISSING)`. (There are some very dubious linter warnings here).

winlogbeat/eventlog/wineventlog.go

andrewkroh · 2022-03-23T18:45:07Z

It looks like there is progress on the message front 👍 . Now the python tests are failing because other rendering info from the XML is missing such as the winlog.keywords and winlog.opcode

andrewkroh · 2022-03-23T18:18:54Z

winlogbeat/eventlog/wineventlog_test.go

+			require.NotEmpty(t, records)
+			require.NoError(t, err)
+			if i == 0 {
+				// The first event in a collection of events created by eventcreate


IIRC the modulo on L186 is bad. The eventcreate event ID values should range on [1-1000] instead of [0-1000]. Saw this too when I was hacking.

Specifies the event ID for the event. A valid ID is any number from 1 to 1000.

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/eventcreate

efd6 · 2022-03-24T07:09:54Z

Now the python tests are failing because other rendering info from the XML is missing such as the winlog.keywords and winlog.opcode

Yea. It's not clear to me how to get that. The change in 7c44687 does the majority of that, but the keywords are not obtainable through that path.

mergify · 2022-03-29T12:33:17Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b wineventlog upstream/wineventlog
git merge upstream/main
git push upstream wineventlog

New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event>

… expressed

andrewkroh

The tests are passing on Windows 2022 🍾

efd6 · 2022-03-30T21:41:03Z

Because of the amount of delint spam, I'll write a fairly detailed commit message since the actual fix was only really two minor changes.

andrewkroh · 2022-03-30T21:59:25Z

That would be helpful, and can you add that message somewhere in the PR description too.

This fixes failures in event handling on Windows 2022[1] where parts of events available from the Windows API are not reflected in the events recovered by winlogbeat[2]. There is unfortunately quite a lot of movement in this change due to the need to satisfy linter requirements. Beyond those changes, the substantive changes here are: 1. Addition of new testing infrastructure to allow addition of evtx files and comparison with there expected XML renderings, and adding some test cases (shown below). 2. Fixing a buffer length parameter in the call to _EvtFormatMessage in evtFormatMessage that was the result of a lack of clarity in the API documentation for that syscall. 3. Fixing a var shadowing decl of the publisher handle EvtHandle in FormatEventString. 4. Providing a call back for the legacy (non-experimental) API through wineventlog.Message to allow it to obtain the event message in the case that the RenderingInfo element is not available via the Windows API. 5. Ensure that keyword, opcode and level are obtained by the non-experimental API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML. This change also required making winevent.Event.OpcodeRaw a pointer to allow an absent System>Opcode element to be distinquished from the zero, but present element. The change also enables testing on Windows 2022. [1]#30621 [2]#30622 (comment) New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event> Co-authored-by: Andrew Kroh <[email protected]> (cherry picked from commit 34bdc3d) # Conflicts: # winlogbeat/beater/winlogbeat.go # winlogbeat/eventlog/wineventlog.go # winlogbeat/eventlog/wineventlog_experimental.go # winlogbeat/sys/wineventlog/wineventlog_windows.go # x-pack/winlogbeat/Jenkinsfile.yml

efd6 · 2022-03-30T23:02:41Z

Do we want to backport to 7.17 and 8.2 as well now?

…ments * upstream/main: winlogbeat: fix event handling for Windows 2022 (elastic#30942) [Release] add-backport-next (elastic#31056)

… fix bugs (#31075) * winlogbeat: fix event handling for Windows 2022 (#30942) This fixes failures in event handling on Windows 2022[1] where parts of events available from the Windows API are not reflected in the events recovered by winlogbeat[2]. There is unfortunately quite a lot of movement in this change due to the need to satisfy linter requirements. Beyond those changes, the substantive changes here are: 1. Addition of new testing infrastructure to allow addition of evtx files and comparison with there expected XML renderings, and adding some test cases (shown below). 2. Fixing a buffer length parameter in the call to _EvtFormatMessage in evtFormatMessage that was the result of a lack of clarity in the API documentation for that syscall. 3. Fixing a var shadowing decl of the publisher handle EvtHandle in FormatEventString. 4. Providing a call back for the legacy (non-experimental) API through wineventlog.Message to allow it to obtain the event message in the case that the RenderingInfo element is not available via the Windows API. 5. Ensure that keyword, opcode and level are obtained by the non-experimental API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML. This change also required making winevent.Event.OpcodeRaw a pointer to allow an absent System>Opcode element to be distinquished from the zero, but present element. The change also enables testing on Windows 2022. [1]#30621 [2]#30622 (comment) New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event> Co-authored-by: Andrew Kroh <[email protected]> (cherry picked from commit 34bdc3d) # Conflicts: # winlogbeat/beater/winlogbeat.go # winlogbeat/eventlog/wineventlog.go # winlogbeat/eventlog/wineventlog_experimental.go # winlogbeat/sys/wineventlog/wineventlog_windows.go # x-pack/winlogbeat/Jenkinsfile.yml * fix conflict Co-authored-by: Dan Kortschak <[email protected]> Co-authored-by: Dan Kortschak <[email protected]>

andrewkroh · 2022-03-31T13:10:29Z

Yeah, let's backport this bugfix into both 8.2 and 7.17.

This fixes failures in event handling on Windows 2022[1] where parts of events available from the Windows API are not reflected in the events recovered by winlogbeat[2]. There is unfortunately quite a lot of movement in this change due to the need to satisfy linter requirements. Beyond those changes, the substantive changes here are: 1. Addition of new testing infrastructure to allow addition of evtx files and comparison with there expected XML renderings, and adding some test cases (shown below). 2. Fixing a buffer length parameter in the call to _EvtFormatMessage in evtFormatMessage that was the result of a lack of clarity in the API documentation for that syscall. 3. Fixing a var shadowing decl of the publisher handle EvtHandle in FormatEventString. 4. Providing a call back for the legacy (non-experimental) API through wineventlog.Message to allow it to obtain the event message in the case that the RenderingInfo element is not available via the Windows API. 5. Ensure that keyword, opcode and level are obtained by the non-experimental API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML. This change also required making winevent.Event.OpcodeRaw a pointer to allow an absent System>Opcode element to be distinquished from the zero, but present element. The change also enables testing on Windows 2022. [1]#30621 [2]#30622 (comment) New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event> Co-authored-by: Andrew Kroh <[email protected]> (cherry picked from commit 34bdc3d) # Conflicts: # winlogbeat/Jenkinsfile.yml # winlogbeat/beater/winlogbeat.go # winlogbeat/eventlog/wineventlog.go # winlogbeat/eventlog/wineventlog_experimental.go # winlogbeat/sys/wineventlog/wineventlog_windows.go # x-pack/winlogbeat/Jenkinsfile.yml

This fixes failures in event handling on Windows 2022[1] where parts of events available from the Windows API are not reflected in the events recovered by winlogbeat[2]. There is unfortunately quite a lot of movement in this change due to the need to satisfy linter requirements. Beyond those changes, the substantive changes here are: 1. Addition of new testing infrastructure to allow addition of evtx files and comparison with there expected XML renderings, and adding some test cases (shown below). 2. Fixing a buffer length parameter in the call to _EvtFormatMessage in evtFormatMessage that was the result of a lack of clarity in the API documentation for that syscall. 3. Fixing a var shadowing decl of the publisher handle EvtHandle in FormatEventString. 4. Providing a call back for the legacy (non-experimental) API through wineventlog.Message to allow it to obtain the event message in the case that the RenderingInfo element is not available via the Windows API. 5. Ensure that keyword, opcode and level are obtained by the non-experimental API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML. This change also required making winevent.Event.OpcodeRaw a pointer to allow an absent System>Opcode element to be distinquished from the zero, but present element. The change also enables testing on Windows 2022. [1]#30621 [2]#30622 (comment) New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event> Co-authored-by: Andrew Kroh <[email protected]> (cherry picked from commit 34bdc3d)

This reverts commit 34bdc3d.

This fixes failures in event handling on Windows 2022[1] where parts of events available from the Windows API are not reflected in the events recovered by winlogbeat[2]. There is unfortunately quite a lot of movement in this change due to the need to satisfy linter requirements. Beyond those changes, the substantive changes here are: 1. Addition of new testing infrastructure to allow addition of evtx files and comparison with there expected XML renderings, and adding some test cases (shown below). 2. Fixing a buffer length parameter in the call to _EvtFormatMessage in evtFormatMessage that was the result of a lack of clarity in the API documentation for that syscall. 3. Fixing a var shadowing decl of the publisher handle EvtHandle in FormatEventString. 4. Providing a call back for the legacy (non-experimental) API through wineventlog.Message to allow it to obtain the event message in the case that the RenderingInfo element is not available via the Windows API. 5. Ensure that keyword, opcode and level are obtained by the non-experimental API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML. This change also required making winevent.Event.OpcodeRaw a pointer to allow an absent System>Opcode element to be distinquished from the zero, but present element. The change also enables testing on Windows 2022. [1]elastic#30621 [2]elastic#30622 (comment) New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event> Co-authored-by: Andrew Kroh <[email protected]>

This fixes failures in event handling on Windows 2022[1] where parts of events available from the Windows API are not reflected in the events recovered by winlogbeat[2]. There is unfortunately quite a lot of movement in this change due to the need to satisfy linter requirements. Beyond those changes, the substantive changes here are: 1. Addition of new testing infrastructure to allow addition of evtx files and comparison with there expected XML renderings, and adding some test cases (shown below). 2. Fixing a buffer length parameter in the call to _EvtFormatMessage in evtFormatMessage that was the result of a lack of clarity in the API documentation for that syscall. 3. Fixing a var shadowing decl of the publisher handle EvtHandle in FormatEventString. 4. Providing a call back for the legacy (non-experimental) API through wineventlog.Message to allow it to obtain the event message in the case that the RenderingInfo element is not available via the Windows API. 5. Ensure that keyword, opcode and level are obtained by the non-experimental API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML. This change also required making winevent.Event.OpcodeRaw a pointer to allow an absent System>Opcode element to be distinquished from the zero, but present element. The change also enables testing on Windows 2022. [1]#30621 [2]#30622 (comment) New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event> Co-authored-by: Andrew Kroh <[email protected]> (cherry picked from commit 34bdc3d) Co-authored-by: Dan Kortschak <[email protected]> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

This fixes failures in event handling on Windows 2022[1] where parts of events available from the Windows API are not reflected in the events recovered by winlogbeat[2]. There is unfortunately quite a lot of movement in this change due to the need to satisfy linter requirements. Beyond those changes, the substantive changes here are: 1. Addition of new testing infrastructure to allow addition of evtx files and comparison with there expected XML renderings, and adding some test cases (shown below). 2. Fixing a buffer length parameter in the call to _EvtFormatMessage in evtFormatMessage that was the result of a lack of clarity in the API documentation for that syscall. 3. Fixing a var shadowing decl of the publisher handle EvtHandle in FormatEventString. 4. Providing a call back for the legacy (non-experimental) API through wineventlog.Message to allow it to obtain the event message in the case that the RenderingInfo element is not available via the Windows API. 5. Ensure that keyword, opcode and level are obtained by the non-experimental API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML. This change also required making winevent.Event.OpcodeRaw a pointer to allow an absent System>Opcode element to be distinquished from the zero, but present element. The change also enables testing on Windows 2022. [1]elastic#30621 [2]elastic#30622 (comment) New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event> Co-authored-by: Andrew Kroh <[email protected]>

…d fix bugs (#31096) * winlogbeat: fix event handling for Windows 2022 (#30942) This fixes failures in event handling on Windows 2022[1] where parts of events available from the Windows API are not reflected in the events recovered by winlogbeat[2]. There is unfortunately quite a lot of movement in this change due to the need to satisfy linter requirements. Beyond those changes, the substantive changes here are: 1. Addition of new testing infrastructure to allow addition of evtx files and comparison with there expected XML renderings, and adding some test cases (shown below). 2. Fixing a buffer length parameter in the call to _EvtFormatMessage in evtFormatMessage that was the result of a lack of clarity in the API documentation for that syscall. 3. Fixing a var shadowing decl of the publisher handle EvtHandle in FormatEventString. 4. Providing a call back for the legacy (non-experimental) API through wineventlog.Message to allow it to obtain the event message in the case that the RenderingInfo element is not available via the Windows API. 5. Ensure that keyword, opcode and level are obtained by the non-experimental API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML. This change also required making winevent.Event.OpcodeRaw a pointer to allow an absent System>Opcode element to be distinquished from the zero, but present element. The change also enables testing on Windows 2022. [1]#30621 [2]#30622 (comment) New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event> Co-authored-by: Andrew Kroh <[email protected]> (cherry picked from commit 34bdc3d) # Conflicts: # winlogbeat/Jenkinsfile.yml # winlogbeat/beater/winlogbeat.go # winlogbeat/eventlog/wineventlog.go # winlogbeat/eventlog/wineventlog_experimental.go # winlogbeat/sys/wineventlog/wineventlog_windows.go # x-pack/winlogbeat/Jenkinsfile.yml * clean up conflict scars * cherrypick winlogbeat test fixes relevant to 7.17 from #31464 Co-authored-by: Dan Kortschak <[email protected]> Co-authored-by: Dan Kortschak <[email protected]>

This fixes failures in event handling on Windows 2022[1] where parts of events available from the Windows API are not reflected in the events recovered by winlogbeat[2]. There is unfortunately quite a lot of movement in this change due to the need to satisfy linter requirements. Beyond those changes, the substantive changes here are: 1. Addition of new testing infrastructure to allow addition of evtx files and comparison with there expected XML renderings, and adding some test cases (shown below). 2. Fixing a buffer length parameter in the call to _EvtFormatMessage in evtFormatMessage that was the result of a lack of clarity in the API documentation for that syscall. 3. Fixing a var shadowing decl of the publisher handle EvtHandle in FormatEventString. 4. Providing a call back for the legacy (non-experimental) API through wineventlog.Message to allow it to obtain the event message in the case that the RenderingInfo element is not available via the Windows API. 5. Ensure that keyword, opcode and level are obtained by the non-experimental API by calling winevent.EnrichRawValuesWithNames in buildRecordFromXML. This change also required making winevent.Event.OpcodeRaw a pointer to allow an absent System>Opcode element to be distinquished from the zero, but present element. The change also enables testing on Windows 2022. [1]#30621 [2]#30622 (comment) New events in testing as rendered by the Event Viewer: ec1: eventcreate /id 1000 /t error /l application /d "My custom error event for the application log" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="EventCreate" /> <EventID Qualifiers="0">1000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.3106672Z" /> <EventRecordID>316</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>My custom error event for the application log</Data> </EventData> </Event> ec2: eventcreate /id 999 /t error /l application /so WinWord /d "Winword event 999 happened due to low diskspace" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinWord" /> <EventID Qualifiers="0">999</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5132246Z" /> <EventRecordID>317</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Winword event 999 happened due to low diskspace</Data> </EventData> </Event> ec3: eventcreate /id 5 /t error /l system /d "Catastrophe!" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="system" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.5455572Z" /> <EventRecordID>1413</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Catastrophe!</Data> </EventData> </Event> ec4: eventcreate /id 5 /t error /l system /so Backup /d "Backup failure" - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Backup" /> <EventID Qualifiers="0">5</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-03-22T02:03:11.8616638Z" /> <EventRecordID>1414</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vagrant</Computer> <Security UserID="S-1-5-21-2297499104-2362337018-4092230427-1000" /> </System> - <EventData> <Data>Backup failure</Data> </EventData> </Event> Co-authored-by: Andrew Kroh <[email protected]>

efd6 added bug Team:Security-External Integrations 8.2-candidate 8.1-candidate backport-v8.1.0 Automated backport with mergify labels Mar 22, 2022

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Mar 22, 2022

mergify bot assigned efd6 Mar 22, 2022

efd6 force-pushed the wineventlog branch from 91fe99b to bc40d4f Compare March 22, 2022 06:04

efd6 force-pushed the wineventlog branch 2 times, most recently from e5f159b to 15ccc7e Compare March 22, 2022 10:07

andrewkroh added the windows-2022 label Mar 22, 2022

efd6 requested a review from a team as a code owner March 22, 2022 20:55

andrewkroh removed the windows-2022 label Mar 22, 2022

efd6 mentioned this pull request Mar 23, 2022

winlogbeat: system.test_wineventlog failures for Windows-2022 #30621

Closed

efd6 commented Mar 23, 2022

View reviewed changes

winlogbeat/eventlog/wineventlog.go Show resolved Hide resolved

andrewkroh reviewed Mar 23, 2022

View reviewed changes

efd6 force-pushed the wineventlog branch from 5964806 to 9c70ae4 Compare March 24, 2022 04:01

efd6 requested a review from a team as a code owner March 30, 2022 01:39

efd6 force-pushed the wineventlog branch from c742d85 to 7bc822c Compare March 30, 2022 01:40

efd6 and others added 3 commits March 30, 2022 12:18

make tests robust to case change in hex values

40a4318

Enable windows-2022 for Winlogbeat testing

22c73e1

use omitempty on a uint8 pointer to allow absence of opcode raw to be…

bc88df8

… expressed

efd6 force-pushed the wineventlog branch from fd5d09b to bc88df8 Compare March 30, 2022 04:20

fix lint

579cc4f

efd6 force-pushed the wineventlog branch from 4261c7f to 579cc4f Compare March 30, 2022 05:54

efd6 requested a review from andrewkroh March 30, 2022 07:21

andrewkroh approved these changes Mar 30, 2022

View reviewed changes

efd6 merged commit 34bdc3d into elastic:main Mar 30, 2022

efd6 deleted the wineventlog branch March 30, 2022 23:01

mergify bot mentioned this pull request Mar 30, 2022

[8.1](backport #30942) winlogbeat/sys/wineventlog: extend testing and fix bugs #31075

Merged

v1v mentioned this pull request Mar 31, 2022

ci: enable windows-2022 for winlogbeat #30622

Closed

v1v added a commit to v1v/beats that referenced this pull request Mar 31, 2022

Merge remote-tracking branch 'upstream/main' into feature/dra-enhance…

4167115

…ments * upstream/main: winlogbeat: fix event handling for Windows 2022 (elastic#30942) [Release] add-backport-next (elastic#31056)

efd6 added backport-v8.2.0 Automated backport with mergify backport-7.17 Automated backport to the 7.17 branch with mergify labels Mar 31, 2022

mergify bot mentioned this pull request Mar 31, 2022

[7.17](backport #30942) winlogbeat/sys/wineventlog: extend testing and fix bugs #31096

Merged

mergify bot mentioned this pull request Mar 31, 2022

[8.2](backport #30942) winlogbeat/sys/wineventlog: extend testing and fix bugs #31097

Merged

rdner mentioned this pull request Apr 4, 2022

[automation] update elastic stack version for testing 8.3.0-1ecd9720 #31098

Merged

efd6 added a commit to efd6/beats that referenced this pull request Apr 4, 2022

Revert "winlogbeat: fix event handling for Windows 2022 (elastic#30942)"

94d13fe

This reverts commit 34bdc3d.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

winlogbeat/sys/wineventlog: extend testing and fix bugs #30942

winlogbeat/sys/wineventlog: extend testing and fix bugs #30942

efd6 commented Mar 22, 2022 •

edited

Loading

elasticmachine commented Mar 22, 2022

elasticmachine commented Mar 22, 2022 •

edited by jenkins-beats-ci bot

Loading

Build stats

Test stats 🧪

andrewkroh commented Mar 22, 2022

efd6 commented Mar 22, 2022 •

edited

Loading

andrewkroh commented Mar 23, 2022

andrewkroh Mar 23, 2022

efd6 commented Mar 24, 2022

mergify bot commented Mar 29, 2022

andrewkroh left a comment

efd6 commented Mar 30, 2022

andrewkroh commented Mar 30, 2022

efd6 commented Mar 30, 2022 •

edited

Loading

andrewkroh commented Mar 31, 2022

winlogbeat/sys/wineventlog: extend testing and fix bugs #30942

winlogbeat/sys/wineventlog: extend testing and fix bugs #30942

Conversation

efd6 commented Mar 22, 2022 • edited Loading

What does this PR do?

Why is it important?

Checklist

Author's Checklist

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

elasticmachine commented Mar 22, 2022

elasticmachine commented Mar 22, 2022 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

🤖 GitHub comments

andrewkroh commented Mar 22, 2022

efd6 commented Mar 22, 2022 • edited Loading

andrewkroh commented Mar 23, 2022

andrewkroh Mar 23, 2022

Choose a reason for hiding this comment

efd6 commented Mar 24, 2022

mergify bot commented Mar 29, 2022

andrewkroh left a comment

Choose a reason for hiding this comment

efd6 commented Mar 30, 2022

andrewkroh commented Mar 30, 2022

efd6 commented Mar 30, 2022 • edited Loading

andrewkroh commented Mar 31, 2022

efd6 commented Mar 22, 2022 •

edited

Loading

elasticmachine commented Mar 22, 2022 •

edited by jenkins-beats-ci bot

Loading

efd6 commented Mar 22, 2022 •

edited

Loading

efd6 commented Mar 30, 2022 •

edited

Loading