Context Navigation

source: nscp/modules/CheckEventLog/CheckEventLog.cpp @ 5da0459

0.4.00.4.10.4.2

Last change on this file since 5da0459 was 5da0459, checked in by Michael Medin <michael@…>, 4 years ago
BROKEN! First attempt at merging...
Property mode set to `100644`
File size: 28.6 KB

Line
1	/**************************************************************************
2	* Copyright (C) 2004-2007 by Michael Medin <michael@medin.name> *
3	* *
4	* This code is part of NSClient++ - http://trac.nakednuns.org/nscp *
5	* *
6	* This program is free software; you can redistribute it and/or modify *
7	* it under the terms of the GNU General Public License as published by *
8	* the Free Software Foundation; either version 2 of the License, or *
9	* (at your option) any later version. *
10	* *
11	* This program is distributed in the hope that it will be useful, *
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of *
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14	* GNU General Public License for more details. *
15	* *
16	* You should have received a copy of the GNU General Public License *
17	* along with this program; if not, write to the *
18	* Free Software Foundation, Inc., *
19	* 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
20	***************************************************************************/
21
22	#include "stdafx.h"
23	#include "CheckEventLog.h"
24	#include <filter_framework.hpp>
25
26	#include <strEx.h>
27	#include <time.h>
28	#include <utils.h>
29	#include <error.hpp>
30	#include <map>
31	#include <vector>
32
33	CheckEventLog gCheckEventLog;
34
35	BOOL APIENTRY DllMain( HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
36	{
37	NSCModuleWrapper::wrapDllMain(hModule, ul_reason_for_call);
38	return TRUE;
39	}
40
41	CheckEventLog::CheckEventLog() {
42	}
43	CheckEventLog::~CheckEventLog() {
44	}
45
46
47	bool CheckEventLog::loadModule(NSCAPI::moduleLoadMode mode) {
48	try {
49
50	if (SETTINGS_GET_BOOL(settings_def::COMPATIBLITY)) {
51	NSC_DEBUG_MSG(_T("Using compatiblity mode in: EventLog Checker"));
52	#define EVENTLOG_SECTION_TITLE _T("Eventlog")
53	#define EVENTLOG_DEBUG _T("debug")
54	#define EVENTLOG_SYNTAX _T("syntax")
55	SETTINGS_MAP_KEY_A(event_log::DEBUG_KEY, EVENTLOG_SECTION_TITLE, EVENTLOG_DEBUG);
56	SETTINGS_MAP_KEY_A(event_log::SYNTAX, EVENTLOG_SECTION_TITLE, EVENTLOG_SYNTAX);
57	}
58	SETTINGS_REG_PATH(event_log::SECTION);
59	SETTINGS_REG_KEY_B(event_log::DEBUG_KEY);
60	SETTINGS_REG_KEY_S(event_log::SYNTAX);
61
62	NSCModuleHelper::registerCommand(_T("CheckEventLog"), _T("Check for errors in the event logger!"));
63	debug_ = SETTINGS_GET_BOOL(event_log::DEBUG_KEY);
64	lookup_names_ = SETTINGS_GET_BOOL(event_log::LOOKUP_NAMES);
65	syntax_ = SETTINGS_GET_STRING(event_log::SYNTAX);
66	buffer_ = SETTINGS_GET_INT(event_log::BUFFER_SIZE);
67	} catch (NSCModuleHelper::NSCMHExcpetion &e) {
68	NSC_LOG_ERROR_STD(_T("Failed to register command: ") + e.msg_);
69	} catch (...) {
70	NSC_LOG_ERROR_STD(_T("Failed to register command."));
71	}
72	return true;
73	}
74	bool CheckEventLog::unloadModule() {
75	return true;
76	}
77
78	bool CheckEventLog::hasCommandHandler() {
79	return true;
80	}
81	bool CheckEventLog::hasMessageHandler() {
82	return false;
83	}
84
85	namespace simple_registry {
86	class registry_exception {
87	std::wstring what_;
88	public:
89	registry_exception(std::wstring what) : what_(what) {}
90	registry_exception(std::wstring path, std::wstring what) : what_(path + _T(" -- ") + what) {}
91	registry_exception(std::wstring path, std::wstring key, std::wstring what) : what_(path + _T(".") + key + _T(" -- ") + what) {}
92	std::wstring what() {
93	return what_;
94	}
95	};
96	class registry_key {
97	HKEY hKey_;
98	std::wstring path_;
99	BYTE *bData_;
100	TCHAR *buffer_;
101	public:
102	registry_key(HKEY hRootKey, std::wstring path) : path_(path), hKey_(NULL), bData_(NULL), buffer_(NULL) {
103	LONG lRet = ERROR_SUCCESS;
104	if (lRet = RegOpenKeyEx(hRootKey, path.c_str(), 0, KEY_QUERY_VALUE\|KEY_READ, &hKey_) != ERROR_SUCCESS)
105	throw registry_exception(path, _T("Failed to open key: ") + error::format::from_system(lRet));
106	}
107	~registry_key() {
108	if (hKey_ != NULL)
109	RegCloseKey(hKey_);
110	delete [] bData_;
111	delete [] buffer_;
112	}
113	std::wstring get_string(std::wstring key, DWORD buffer_length = 2048) {
114	DWORD type;
115	std::wstring ret;
116	DWORD cbData = buffer_length;
117	delete [] bData_;
118	bData_ = new BYTE[cbData+2];
119	// TODO: add get size here !
120	LONG lRet = RegQueryValueEx(hKey_, key.c_str(), NULL, &type, bData_, &cbData);
121	if (lRet != ERROR_SUCCESS)
122	throw registry_exception(path_, key, _T("Failed to get value: ") + error::format::from_system(lRet));
123	if (cbData >= buffer_length \|\| cbData < 0)
124	throw registry_exception(path_, key, _T("Failed to get value: buffer to small"));
125	bData_[cbData] = 0;
126	if (type == REG_SZ) {
127	ret = reinterpret_cast<LPCTSTR>(bData_);
128	} else if (type == REG_EXPAND_SZ) {
129	std::wstring s = reinterpret_cast<LPCTSTR>(bData_);
130	delete [] buffer_;
131	buffer_ = new TCHAR[buffer_length+1];
132	DWORD expRet = ExpandEnvironmentStrings(s.c_str(), buffer_, buffer_length);
133	if (expRet >= buffer_length)
134	throw registry_exception(path_, key, _T("Buffer to small (expand)"));
135	else
136	ret = buffer_;
137	} else {
138	throw registry_exception(path_, key, _T("Unknown type (not a string)"));
139	}
140	return ret;
141	}
142	DWORD get_int(std::wstring key) {
143	DWORD type;
144	DWORD cbData = sizeof(DWORD);
145	DWORD ret = 0;
146	LONG lRet = RegQueryValueEx(hKey_, key.c_str(), NULL, &type, reinterpret_cast<LPBYTE>(&ret), &cbData);
147	if (lRet != ERROR_SUCCESS)
148	throw registry_exception(path_, key, _T("Failed to get value: ") + error::format::from_system(lRet));
149	if (type != REG_DWORD)
150	throw registry_exception(path_, key, _T("Unknown type (not a DWORD)"));
151	return ret;
152	}
153
154	std::list<std::wstring> get_keys(DWORD buffer_length = 2048) {
155	std::list<std::wstring> ret;
156	DWORD cSubKeys=0;
157	DWORD cMaxKeyLen;
158	// Get the class name and the value count.
159	LONG lRet = RegQueryInfoKey(hKey_,NULL,NULL,NULL,&cSubKeys,&cMaxKeyLen,NULL,NULL,NULL,NULL,NULL,NULL);
160	if (lRet != ERROR_SUCCESS)
161	throw registry_exception(path_, _T("Failed to query key info: ") + error::format::from_system(lRet));
162	if (cSubKeys == 0)
163	return ret;
164	delete [] buffer_;
165	buffer_ = new TCHAR[cMaxKeyLen+20];
166	for (unsigned int i=0; i<cSubKeys; i++) {
167	lRet = RegEnumKey(hKey_, i, buffer_, cMaxKeyLen+10);
168	if (lRet != ERROR_SUCCESS) {
169	throw registry_exception(path_, _T("Failed to enumerate: ") + error::lookup::last_error(lRet));
170	}
171	std::wstring str = buffer_;
172	ret.push_back(str);
173	}
174	return ret;
175	}
176
177	};
178
179	std::wstring get_string(HKEY hKey, std::wstring path, std::wstring key) {
180	registry_key reg(hKey, path);
181	return reg.get_string(key);
182	}
183	}
184
185	std::wstring find_eventlog_name(std::wstring name) {
186	try {
187	simple_registry::registry_key key(HKEY_LOCAL_MACHINE, _T("SYSTEM\\CurrentControlSet\\Services\\EventLog"));
188	std::list<std::wstring> list = key.get_keys();
189	for (std::list<std::wstring>::const_iterator cit = list.begin(); cit != list.end(); ++cit) {
190	try {
191	simple_registry::registry_key sub_key(HKEY_LOCAL_MACHINE, _T("SYSTEM\\CurrentControlSet\\Services\\EventLog\\") + *cit);
192	std::wstring file = sub_key.get_string(_T("DisplayNameFile"));
193	int id = sub_key.get_int(_T("DisplayNameID"));
194	std::wstring real_name = error::format::message::from_module(file, id);
195	strEx::replace(real_name, _T("\n"), _T(""));
196	strEx::replace(real_name, _T("\r"), _T(""));
197	NSC_DEBUG_MSG(_T("Attempting to match: ") + real_name + _T(" with ") + name);
198	if (real_name == name)
199	return *cit;
200	} catch (simple_registry::registry_exception &e) {}
201	}
202	return name;
203	} catch (simple_registry::registry_exception &e) {
204	NSC_DEBUG_MSG(_T("Failed to get eventlog name (assuming shorthand): ") + e.what());
205	return name;
206	} catch (...) {
207	NSC_DEBUG_MSG(_T("Failed to get eventlog name (assuming shorthand)"));
208	return name;
209	}
210	}
211
212	class EventLogRecord {
213	EVENTLOGRECORD *pevlr_;
214	__int64 currentTime_;
215	std::wstring file_;
216	public:
217	EventLogRecord(std::wstring file, EVENTLOGRECORD *pevlr, __int64 currentTime) : file_(file), pevlr_(pevlr), currentTime_(currentTime) {
218	}
219	inline __int64 timeGenerated() const {
220	return (currentTime_-pevlr_->TimeGenerated)*1000;
221	}
222	inline __int64 timeWritten() const {
223	return (currentTime_-pevlr_->TimeWritten)*1000;
224	}
225	inline std::wstring eventSource() const {
226	return reinterpret_cast<WCHAR*>(reinterpret_cast<LPBYTE>(pevlr_) + sizeof(EVENTLOGRECORD));
227	}
228	inline DWORD eventID() const {
229	return (pevlr_->EventID&0xffff);
230	}
231	inline DWORD severity() const {
232	return (pevlr_->EventID>>30);
233	}
234
235	inline DWORD eventType() const {
236	return pevlr_->EventType;
237	}
238	/*
239	std::wstring userSID() const {
240	if (pevlr_->UserSidOffset == 0)
241	return "";
242	PSID p = reinterpret_cast<PSID>(reinterpret_cast<LPBYTE>(pevlr_) + + pevlr_->UserSidOffset);
243	LPSTR user = new CHAR[1025];
244	LPSTR domain = new CHAR[1025];
245	DWORD userLen = 1024;
246	DWORD domainLen = 1024;
247	SID_NAME_USE sidName;
248	LookupAccountSid(NULL, p, user, &userLen, domain, &domainLen, &sidName);
249	user[userLen] = 0;
250	domain[domainLen] = 0;
251	return std::wstring(domain) + "\\" + std::wstring(user);
252	}
253	*/
254
255	std::wstring enumStrings() const {
256	std::wstring ret;
257	TCHAR* p = reinterpret_cast<TCHAR*>(reinterpret_cast<LPBYTE>(pevlr_) + pevlr_->StringOffset);
258	for (unsigned int i =0;i<pevlr_->NumStrings;i++) {
259	std::wstring s = p;
260	if (!s.empty())
261	s += _T(", ");
262	ret += s;
263	p+= wcslen(p)+1;
264	}
265	return ret;
266	}
267
268	static DWORD appendType(DWORD dwType, std::wstring sType) {
269	return dwType \| translateType(sType);
270	}
271	static DWORD subtractType(DWORD dwType, std::wstring sType) {
272	return dwType & (!translateType(sType));
273	}
274	static DWORD translateType(std::wstring sType) {
275	if (sType == _T("error"))
276	return EVENTLOG_ERROR_TYPE;
277	if (sType == _T("warning"))
278	return EVENTLOG_WARNING_TYPE;
279	if (sType == _T("info"))
280	return EVENTLOG_INFORMATION_TYPE;
281	if (sType == _T("auditSuccess"))
282	return EVENTLOG_AUDIT_SUCCESS;
283	if (sType == _T("auditFailure"))
284	return EVENTLOG_AUDIT_FAILURE;
285	return strEx::stoi(sType);
286	}
287	static std::wstring translateType(DWORD dwType) {
288	if (dwType == EVENTLOG_ERROR_TYPE)
289	return _T("error");
290	if (dwType == EVENTLOG_WARNING_TYPE)
291	return _T("warning");
292	if (dwType == EVENTLOG_INFORMATION_TYPE)
293	return _T("info");
294	if (dwType == EVENTLOG_AUDIT_SUCCESS)
295	return _T("auditSuccess");
296	if (dwType == EVENTLOG_AUDIT_FAILURE)
297	return _T("auditFailure");
298	return strEx::itos(dwType);
299	}
300	static DWORD translateSeverity(std::wstring sType) {
301	if (sType == _T("success"))
302	return 0;
303	if (sType == _T("informational"))
304	return 1;
305	if (sType == _T("warning"))
306	return 2;
307	if (sType == _T("error"))
308	return 3;
309	return strEx::stoi(sType);
310	}
311	static std::wstring translateSeverity(DWORD dwType) {
312	if (dwType == 0)
313	return _T("success");
314	if (dwType == 1)
315	return _T("informational");
316	if (dwType == 2)
317	return _T("warning");
318	if (dwType == 3)
319	return _T("error");
320	return strEx::itos(dwType);
321	}
322	std::wstring get_dll() {
323	try {
324	return simple_registry::get_string(HKEY_LOCAL_MACHINE, _T("SYSTEM\\CurrentControlSet\\Services\\EventLog\\") + file_ + (std::wstring)_T("\\") + eventSource(), _T("EventMessageFile"));
325	} catch (simple_registry::registry_exception &e) {
326	NSC_LOG_ERROR_STD(_T("Could not extract DLL for eventsource: ") + eventSource() + _T(": ") + e.what());
327	return _T("");
328	}
329	}
330
331	std::wstring render_message() {
332	std::vector<std::wstring> args;
333	TCHAR* pArgs = new TCHAR[pevlr_->NumStrings+1];
334	TCHAR* p = reinterpret_cast<TCHAR*>(reinterpret_cast<LPBYTE>(pevlr_) + pevlr_->StringOffset);
335	for (unsigned int i =0;i<pevlr_->NumStrings;i++) {
336	args.push_back(p);
337	pArgs[i] = p;
338	DWORD len = wcslen(p);
339	p = &(p[len+1]);
340	//p += len+1;
341	}
342
343	std::wstring ret;
344	strEx::splitList dlls = strEx::splitEx(get_dll(), _T(";"));
345	for (strEx::splitList::const_iterator cit = dlls.begin(); cit != dlls.end(); ++cit) {
346	//std::wstring msg = error::format::message::from_module((*cit), eventID(), _sz);
347	std::wstring msg;
348	try {
349	msg = error::format::message::from_module_x64((*cit), eventID(), pArgs, pevlr_->NumStrings);
350	if (msg.empty()) {
351	msg = error::format::message::from_module_x64((*cit), pevlr_->EventID, pArgs, pevlr_->NumStrings);
352	}
353	} catch (...) {
354	msg = _T("Unknown exception getting message");
355	}
356	strEx::replace(msg, _T("\n"), _T(" "));
357	strEx::replace(msg, _T("\t"), _T(" "));
358	std::string::size_type pos = msg.find_last_not_of(_T("\n\t "));
359	if (pos != std::string::npos) {
360	msg = msg.substr(0,pos);
361	}
362	if (!msg.empty()) {
363	if (!ret.empty())
364	ret += _T(", ");
365	ret += msg;
366	}
367	}
368	delete [] pArgs;
369	return ret;
370	}
371	SYSTEMTIME get_time(DWORD time) {
372	FILETIME FileTime, LocalFileTime;
373	SYSTEMTIME SysTime;
374	__int64 lgTemp;
375	__int64 SecsTo1970 = 116444736000000000;
376
377	lgTemp = Int32x32To64(time,10000000) + SecsTo1970;
378
379	FileTime.dwLowDateTime = (DWORD) lgTemp;
380	FileTime.dwHighDateTime = (DWORD)(lgTemp >> 32);
381
382	FileTimeToLocalFileTime(&FileTime, &LocalFileTime);
383	FileTimeToSystemTime(&LocalFileTime, &SysTime);
384	return SysTime;
385	}
386
387	SYSTEMTIME get_time_generated() {
388	return get_time(pevlr_->TimeGenerated);
389	}
390	SYSTEMTIME get_time_written() {
391	return get_time(pevlr_->TimeWritten);
392	}
393
394	std::wstring render(bool propper, std::wstring syntax, std::wstring date_format = DATE_FORMAT) {
395	if (propper) {
396	// To obtain the appropriate message string from the message file, load the message file with the LoadLibrary function and use the FormatMessage function
397	strEx::replace(syntax, _T("%message%"), render_message());
398	} else {
399	strEx::replace(syntax, _T("%message%"), _T("%message% needs the descriptions flag set!"));
400	}
401
402	strEx::replace(syntax, _T("%source%"), eventSource());
403	strEx::replace(syntax, _T("%generated%"), strEx::format_date(get_time_generated(), date_format));
404	strEx::replace(syntax, _T("%written%"), strEx::format_date(get_time_written(), date_format));
405	strEx::replace(syntax, _T("%type%"), translateType(eventType()));
406	strEx::replace(syntax, _T("%severity%"), translateSeverity(severity()));
407	strEx::replace(syntax, _T("%strings%"), enumStrings());
408	strEx::replace(syntax, _T("%id%"), strEx::itos(eventID()));
409	return syntax;
410	}
411	};
412	/*
413	return (pevlr_->EventID&0xffff);
414	}
415	inline DWORD severity() const {
416	return (pevlr_->EventID>>30);
417	*/
418	class uniq_eventlog_record {
419	DWORD ID;
420	WORD type;
421	WORD category;
422	public:
423	std::wstring message;
424	uniq_eventlog_record(EVENTLOGRECORD *pevlr) : ID(pevlr->EventID&0xffff), type(pevlr->EventType), category(pevlr->EventCategory) {}
425	bool operator< (const uniq_eventlog_record &other) const {
426	return (ID < other.ID) \|\| ((ID==other.ID)&&(type < other.type)) \|\| (ID==other.ID&&type==other.type)&&(category < other.category);
427	}
428	std::wstring to_string() const {
429	return _T("id=") + strEx::itos(ID) + _T("type=") + strEx::itos(type) + _T("category=") + strEx::itos(category);
430	}
431	};
432	typedef std::map<uniq_eventlog_record,unsigned int> uniq_eventlog_map;
433
434
435	struct eventlog_filter {
436	filters::filter_all_strings eventSource;
437	filters::filter_all_numeric<unsigned int, filters::handlers::eventtype_handler> eventType;
438	filters::filter_all_numeric<unsigned int, filters::handlers::eventseverity_handler> eventSeverity;
439	filters::filter_all_strings message;
440	filters::filter_all_times timeWritten;
441	filters::filter_all_times timeGenerated;
442	filters::filter_all_numeric<DWORD, filters::handlers::eventtype_handler> eventID;
443	std::wstring value_;
444
445	inline bool hasFilter() {
446	return eventSource.hasFilter() \|\| eventType.hasFilter() \|\| eventID.hasFilter() \|\| eventSeverity.hasFilter() \|\| message.hasFilter() \|\|
447	timeWritten.hasFilter() \|\| timeGenerated.hasFilter();
448	}
449	std::wstring getValue() const {
450	if (eventSource.hasFilter())
451	return _T("event-source: ") + eventSource.getValue();
452	if (eventType.hasFilter())
453	return _T("event-type: ") + eventType.getValue();
454	if (eventSeverity.hasFilter())
455	return _T("severity: ") + eventSeverity.getValue();
456	if (eventID.hasFilter())
457	return _T("event-id: ") + eventID.getValue();
458	if (message.hasFilter())
459	return _T("message: ") + message.getValue();
460	if (timeWritten.hasFilter())
461	return _T("time-written: ") + timeWritten.getValue();
462	if (timeGenerated.hasFilter())
463	return _T("time-generated: ") + timeGenerated.getValue();
464	return _T("UNknown...");
465	}
466	bool matchFilter(const EventLogRecord &value) const {
467	if ((eventSource.hasFilter())&&(eventSource.matchFilter(value.eventSource())))
468	return true;
469	else if ((eventType.hasFilter())&&(eventType.matchFilter(value.eventType())))
470	return true;
471	else if ((eventSeverity.hasFilter())&&(eventSeverity.matchFilter(value.severity())))
472	return true;
473	else if ((eventID.hasFilter())&&(eventID.matchFilter(value.eventID())))
474	return true;
475	else if ((message.hasFilter())&&(message.matchFilter(value.enumStrings())))
476	return true;
477	else if ((timeWritten.hasFilter())&&(timeWritten.matchFilter(value.timeWritten())))
478	return true;
479	else if ((timeGenerated.hasFilter())&&(timeGenerated.matchFilter(value.timeGenerated())))
480	return true;
481	return false;
482	}
483	};
484
485
486	#define MAP_FILTER(value, obj, filtermode) \
487	else if (p__.first == value) { eventlog_filter filter; filter.obj = p__.second; filter_chain.push_back(filteritem_type(filtermode, filter)); }
488
489	struct event_log_buffer {
490	BYTE *bBuffer;
491	DWORD bufferSize_;
492	event_log_buffer(DWORD bufferSize) : bufferSize_(bufferSize) {
493	bBuffer = new BYTE[bufferSize+10];
494	}
495	~event_log_buffer() {
496	delete [] bBuffer;
497	}
498	EVENTLOGRECORD* getBufferUnsafe() {
499	return reinterpret_cast<EVENTLOGRECORD*>(bBuffer);
500	}
501	DWORD getBufferSize() {
502	return bufferSize_;
503	}
504	};
505
506	NSCAPI::nagiosReturn CheckEventLog::handleCommand(const strEx::blindstr command, const unsigned int argLen, TCHAR **char_args, std::wstring &message, std::wstring &perf) {
507	if (command != _T("CheckEventLog"))
508	return NSCAPI::returnIgnored;
509	typedef checkHolders::CheckContainer<checkHolders::MaxMinBoundsULongInteger> EventLogQuery1Container;
510	typedef checkHolders::CheckContainer<checkHolders::ExactBoundsULongInteger> EventLogQuery2Container;
511
512	typedef std::pair<int,eventlog_filter> filteritem_type;
513	typedef std::list<filteritem_type > filterlist_type;
514	NSCAPI::nagiosReturn returnCode = NSCAPI::returnOK;
515	std::list<std::wstring> stl_args = arrayBuffer::arrayBuffer2list(argLen, char_args);
516
517	std::list<std::wstring> files;
518	filterlist_type filter_chain;
519	EventLogQuery1Container query1;
520	EventLogQuery2Container query2;
521
522	bool bPerfData = true;
523	bool bFilterIn = true;
524	bool bFilterAll = false;
525	bool bFilterNew = true;
526	bool bShowDescriptions = false;
527	bool unique = false;
528	unsigned int truncate = 0;
529	std::wstring syntax = syntax_;
530	const int filter_plus = 1;
531	const int filter_minus = 2;
532	const int filter_normal = 3;
533	const int filter_compat = 3;
534	event_log_buffer buffer(buffer_length_);
535	/*
536	try {
537	event_log_buffer buffer(buffer_length_);
538	} catch (std::exception e) {
539	message = std::wstring(_T("Failed to allocate memory: ")) + strEx::string_to_wstring(e.what());
540	return NSCAPI::returnUNKNOWN;
541	}
542	*/
543
544	try {
545	MAP_OPTIONS_BEGIN(stl_args)
546	MAP_OPTIONS_NUMERIC_ALL(query1, _T(""))
547	MAP_OPTIONS_EXACT_NUMERIC_ALL(query2, _T(""))
548	MAP_OPTIONS_STR2INT(_T("truncate"), truncate)
549	MAP_OPTIONS_BOOL_TRUE(_T("unique"), unique)
550	MAP_OPTIONS_BOOL_TRUE(_T("descriptions"), bShowDescriptions)
551	MAP_OPTIONS_PUSH(_T("file"), files)
552	MAP_OPTIONS_BOOL_FALSE(IGNORE_PERFDATA, bPerfData)
553	MAP_OPTIONS_BOOL_EX(_T("filter"), bFilterNew, _T("new"), _T("old"))
554	MAP_OPTIONS_BOOL_EX(_T("filter"), bFilterIn, _T("in"), _T("out"))
555	MAP_OPTIONS_BOOL_EX(_T("filter"), bFilterAll, _T("all"), _T("any"))
556	MAP_OPTIONS_STR(_T("syntax"), syntax)
557	/*
558	MAP_FILTER_OLD("filter-eventType", eventType)
559	MAP_FILTER_OLD("filter-severity", eventSeverity)
560	MAP_FILTER_OLD("filter-eventID", eventID)
561	MAP_FILTER_OLD("filter-eventSource", eventSource)
562	MAP_FILTER_OLD("filter-generated", timeGenerated)
563	MAP_FILTER_OLD("filter-written", timeWritten)
564	MAP_FILTER_OLD("filter-message", message)
565	*/
566	MAP_FILTER(_T("filter+eventType"), eventType, filter_plus)
567	MAP_FILTER(_T("filter+severity"), eventSeverity, filter_plus)
568	MAP_FILTER(_T("filter+eventID"), eventID, filter_plus)
569	MAP_FILTER(_T("filter+eventSource"), eventSource, filter_plus)
570	MAP_FILTER(_T("filter+generated"), timeGenerated, filter_plus)
571	MAP_FILTER(_T("filter+written"), timeWritten, filter_plus)
572	MAP_FILTER(_T("filter+message"), message, filter_plus)
573
574	MAP_FILTER(_T("filter.eventType"), eventType, filter_normal)
575	MAP_FILTER(_T("filter.severity"), eventSeverity, filter_normal)
576	MAP_FILTER(_T("filter.eventID"), eventID, filter_normal)
577	MAP_FILTER(_T("filter.eventSource"), eventSource, filter_normal)
578	MAP_FILTER(_T("filter.generated"), timeGenerated, filter_normal)
579	MAP_FILTER(_T("filter.written"), timeWritten, filter_normal)
580	MAP_FILTER(_T("filter.message"), message, filter_normal)
581
582	MAP_FILTER(_T("filter-eventType"), eventType, filter_minus)
583	MAP_FILTER(_T("filter-severity"), eventSeverity, filter_minus)
584	MAP_FILTER(_T("filter-eventID"), eventID, filter_minus)
585	MAP_FILTER(_T("filter-eventSource"), eventSource, filter_minus)
586	MAP_FILTER(_T("filter-generated"), timeGenerated, filter_minus)
587	MAP_FILTER(_T("filter-written"), timeWritten, filter_minus)
588	MAP_FILTER(_T("filter-message"), message, filter_minus)
589
590	MAP_OPTIONS_MISSING(message, _T("Unknown argument: "))
591	MAP_OPTIONS_END()
592	} catch (filters::parse_exception e) {
593	message = e.getMessage();
594	return NSCAPI::returnUNKNOWN;
595	} catch (filters::filter_exception e) {
596	message = e.getMessage();
597	return NSCAPI::returnUNKNOWN;
598	} catch (checkHolders::parse_exception e) {
599	message = e.getMessage();
600	return NSCAPI::returnUNKNOWN;
601	} catch (...) {
602	message = _T("Invalid command line!");
603	return NSCAPI::returnUNKNOWN;
604	}
605
606	unsigned long int hit_count = 0;
607	if (files.empty()) {
608	message = _T("No file specified try adding: file=Application");
609	return NSCAPI::returnUNKNOWN;
610	}
611	bool buffer_error_reported = false;
612
613	for (std::list<std::wstring>::const_iterator cit2 = files.begin(); cit2 != files.end(); ++cit2) {
614	std::wstring name = *cit2;
615	if (lookup_names_) {
616	name = find_eventlog_name(*cit2);
617	if ((*cit2) != name) {
618	NSC_DEBUG_MSG_STD(_T("Opening alternative log: ") + name);
619	}
620	}
621	HANDLE hLog = OpenEventLog(NULL, name.c_str());
622	if (hLog == NULL) {
623	message = _T("Could not open the '") + (*cit2) + _T("' event log: ") + error::lookup::last_error();
624	return NSCAPI::returnUNKNOWN;
625	}
626	uniq_eventlog_map uniq_records;
627
628	//DWORD dwThisRecord;
629	DWORD dwRead, dwNeeded;
630
631
632	__time64_t ltime;
633	_time64(&ltime);
634
635	//GetOldestEventLogRecord(hLog, &dwThisRecord);
636
637	while (true) {
638	BOOL bStatus = ReadEventLog(hLog, EVENTLOG_FORWARDS_READ\|EVENTLOG_SEQUENTIAL_READ,
639	0, buffer.getBufferUnsafe(), buffer.getBufferSize(), &dwRead, &dwNeeded);
640	if (bStatus == FALSE) {
641	DWORD err = GetLastError();
642	if (err == ERROR_INSUFFICIENT_BUFFER) {
643	if (!buffer_error_reported) {
644	NSC_LOG_ERROR_STD(_T("EvenlogBuffer is too small change the value of ") + EVENTLOG_BUFFER + _T("=") + strEx::itos(dwNeeded+1) + _T(" under [EventLog] in nsc.ini : ") + error::lookup::last_error(err));
645	buffer_error_reported = true;
646	}
647	} else if (err == ERROR_HANDLE_EOF) {
648	break;
649	} else {
650	NSC_LOG_ERROR_STD(_T("Failed to read from eventlog: ") + error::lookup::last_error(err));
651	message = _T("Failed to read from eventlog: ") + error::lookup::last_error(err);
652	CloseEventLog(hLog);
653	return NSCAPI::returnUNKNOWN;
654	}
655	}
656	EVENTLOGRECORD *pevlr = buffer.getBufferUnsafe();
657	while (dwRead > 0) {
658	//bool bMatch = bFilterAll;
659	bool bMatch = !bFilterIn;
660	EventLogRecord record((*cit2), pevlr, ltime);
661
662	if (filter_chain.empty()) {
663	message = _T("No filters specified try adding: filter+generated=>2d");
664	return NSCAPI::returnUNKNOWN;
665	}
666
667
668	for (filterlist_type::const_iterator cit3 = filter_chain.begin(); cit3 != filter_chain.end(); ++cit3 ) {
669	std::wstring reason;
670	int mode = (*cit3).first;
671	bool bTmpMatched = (*cit3).second.matchFilter(record);
672	if (!bFilterNew) {
673	if (bFilterAll) {
674	if (!bTmpMatched) {
675	bMatch = false;
676	break;
677	}
678	} else {
679	if (bTmpMatched) {
680	bMatch = true;
681	break;
682	}
683	}
684	} else {
685	if ((mode == filter_minus)&&(bTmpMatched)) {
686	// a -<filter> hit so thrash item and bail out!
687	if (debug_)
688	NSC_DEBUG_MSG_STD(_T("Matched: - ") + (*cit3).second.getValue() + _T(" for: ") + record.render(bShowDescriptions, syntax));
689	bMatch = false;
690	break;
691	} else if ((mode == filter_plus)&&(!bTmpMatched)) {
692	// a +<filter> missed hit so thrash item and bail out!
693	if (debug_)
694	NSC_DEBUG_MSG_STD(_T("Matched: + ") + (*cit3).second.getValue() + _T(" for: ") + record.render(bShowDescriptions, syntax));
695	bMatch = false;
696	break;
697	} else if (bTmpMatched) {
698	if (debug_)
699	NSC_DEBUG_MSG_STD(_T("Matched: . (contiunue): ") + (*cit3).second.getValue() + _T(" for: ") + record.render(bShowDescriptions, syntax));
700	bMatch = true;
701	}
702	}
703	}
704	bool match = false;
705	if ((!bFilterNew)&&((bFilterIn&&bMatch)\|\|(!bFilterIn&&!bMatch))) {
706	match = true;
707	} else if (bFilterNew&&bMatch) {
708	match = true;
709	}
710	if (match&&unique) {
711	match = false;
712	uniq_eventlog_record uniq_record = pevlr;
713	uniq_eventlog_map::iterator it = uniq_records.find(uniq_record);
714	if (it != uniq_records.end()) {
715	(*it).second ++;
716	//match = false;
717	}
718	else {
719	if (!syntax.empty()) {
720	uniq_record.message = record.render(bShowDescriptions, syntax);
721	} else if (!bShowDescriptions) {
722	uniq_record.message = record.eventSource();
723	} else {
724	uniq_record.message = record.eventSource();
725	uniq_record.message += _T("(") + EventLogRecord::translateType(record.eventType()) + _T(", ") +
726	strEx::itos(record.eventID()) + _T(", ") + EventLogRecord::translateSeverity(record.severity()) + _T(")");
727	uniq_record.message += _T("[") + record.enumStrings() + _T("]");
728	uniq_record.message += _T("{%count%}");
729	}
730	uniq_records[uniq_record] = 1;
731	}
732	hit_count++;
733	} else if (match) {
734	if (!syntax.empty()) {
735	strEx::append_list(message, record.render(bShowDescriptions, syntax));
736	} else if (!bShowDescriptions) {
737	strEx::append_list(message, record.eventSource());
738	} else {
739	strEx::append_list(message, record.eventSource());
740	message += _T("(") + EventLogRecord::translateType(record.eventType()) + _T(", ") +
741	strEx::itos(record.eventID()) + _T(", ") + EventLogRecord::translateSeverity(record.severity()) + _T(")");
742	message += _T("[") + record.enumStrings() + _T("]");
743	}
744	hit_count++;
745	}
746	dwRead -= pevlr->Length;
747	pevlr = reinterpret_cast<EVENTLOGRECORD*>((LPBYTE)pevlr + pevlr->Length);
748	}
749	}
750	}
751	DWORD err = GetLastError();
752	if (err == ERROR_INSUFFICIENT_BUFFER) {
753	NSC_LOG_ERROR_STD(_T("EvenlogBuffer is too small (set the value of ") + settings::event_log::BUFFER_SIZE_TITLE + _T("): ") + error::lookup::last_error(err));
754	message = std::wstring(_T("EvenlogBuffer is too small (set the value of ")) + settings::event_log::BUFFER_SIZE_TITLE + _T("): ") + error::lookup::last_error(err);
755	return NSCAPI::returnUNKNOWN;
756	} else if (err != ERROR_HANDLE_EOF) {
757	NSC_LOG_ERROR_STD(_T("Failed to read from eventlog: ") + error::lookup::last_error(err));
758	message = _T("Failed to read from eventlog: ") + error::lookup::last_error(err);
759	return NSCAPI::returnUNKNOWN;
760	}
761	CloseEventLog(hLog);
762	for (uniq_eventlog_map::const_iterator cit = uniq_records.begin(); cit != uniq_records.end(); ++cit) {
763	std::wstring msg = (*cit).first.message;
764	strEx::replace(msg, _T("%count%"), strEx::itos((*cit).second));
765	strEx::append_list(message, msg);
766	}
767	}
768
769	if (!bPerfData) {
770	query1.perfData = false;
771	query2.perfData = false;
772	}
773	if (query1.alias.empty())
774	query1.alias = _T("eventlog");
775	if (query2.alias.empty())
776	query2.alias = _T("eventlog");
777	if (query1.hasBounds())
778	query1.runCheck(hit_count, returnCode, message, perf);
779	else if (query2.hasBounds())
780	query2.runCheck(hit_count, returnCode, message, perf);
781	else {
782	message = _T("No bounds specified!");
783	return NSCAPI::returnUNKNOWN;
784	}
785	if (!bPerfData)
786	query.perfData = false;
787	if (query.alias.empty())
788	query.alias = _T("eventlog");
789	query.runCheck(hit_count, returnCode, message, perf);
790	if ((truncate > 0) && (message.length() > (truncate-4)))
791	message = message.substr(0, truncate-4) + _T("...");
792	if (message.empty())
793	message = _T("Eventlog check ok");
794	return returnCode;
795	}
796
797
798	NSC_WRAPPERS_MAIN_DEF(gCheckEventLog);
799	NSC_WRAPPERS_IGNORE_MSG_DEF();
800	NSC_WRAPPERS_HANDLE_CMD_DEF(gCheckEventLog);

Note: See TracBrowser for help on using the repository browser.

Download in other formats: