Context Navigation

source: nscp/modules/CheckEventLog/CheckEventLog.cpp @ 739db5a

0.4.00.4.10.4.2

Last change on this file since 739db5a was 739db5a, checked in by Michael Medin <michael@…>, 5 years ago
First attempt at merging stable changes over to here (probably needs more work, but compiles and starts...)
Property mode set to `100644`
File size: 27.0 KB

Line
1	/**************************************************************************
2	* Copyright (C) 2004-2007 by Michael Medin <michael@medin.name> *
3	* *
4	* This code is part of NSClient++ - http://trac.nakednuns.org/nscp *
5	* *
6	* This program is free software; you can redistribute it and/or modify *
7	* it under the terms of the GNU General Public License as published by *
8	* the Free Software Foundation; either version 2 of the License, or *
9	* (at your option) any later version. *
10	* *
11	* This program is distributed in the hope that it will be useful, *
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of *
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14	* GNU General Public License for more details. *
15	* *
16	* You should have received a copy of the GNU General Public License *
17	* along with this program; if not, write to the *
18	* Free Software Foundation, Inc., *
19	* 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
20	***************************************************************************/
21
22	#include "stdafx.h"
23	#include "CheckEventLog.h"
24	#include <filter_framework.hpp>
25
26	#include <strEx.h>
27	#include <time.h>
28	#include <utils.h>
29	#include <error.hpp>
30	#include <map>
31
32	CheckEventLog gCheckEventLog;
33
34	BOOL APIENTRY DllMain( HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
35	{
36	NSCModuleWrapper::wrapDllMain(hModule, ul_reason_for_call);
37	return TRUE;
38	}
39
40	CheckEventLog::CheckEventLog() {
41	}
42	CheckEventLog::~CheckEventLog() {
43	}
44
45
46	bool CheckEventLog::loadModule(NSCAPI::moduleLoadMode mode) {
47	try {
48
49	if (SETTINGS_GET_BOOL(settings_def::COMPATIBLITY)) {
50	NSC_DEBUG_MSG(_T("Using compatiblity mode in: EventLog Checker"));
51	#define EVENTLOG_SECTION_TITLE _T("Eventlog")
52	#define EVENTLOG_DEBUG _T("debug")
53	#define EVENTLOG_SYNTAX _T("syntax")
54	SETTINGS_MAP_KEY_A(event_log::DEBUG_KEY, EVENTLOG_SECTION_TITLE, EVENTLOG_DEBUG);
55	SETTINGS_MAP_KEY_A(event_log::SYNTAX, EVENTLOG_SECTION_TITLE, EVENTLOG_SYNTAX);
56	}
57	SETTINGS_REG_PATH(event_log::SECTION);
58	SETTINGS_REG_KEY_B(event_log::DEBUG_KEY);
59	SETTINGS_REG_KEY_S(event_log::SYNTAX);
60
61	NSCModuleHelper::registerCommand(_T("CheckEventLog"), _T("Check for errors in the event logger!"));
62	debug_ = SETTINGS_GET_BOOL(event_log::DEBUG_KEY);
63	lookup_names_ = SETTINGS_GET_BOOL(event_log::LOOKUP_NAMES);
64	syntax_ = SETTINGS_GET_STRING(event_log::SYNTAX);
65	buffer_ = SETTINGS_GET_INT(event_log::BUFFER_SIZE);
66	} catch (NSCModuleHelper::NSCMHExcpetion &e) {
67	NSC_LOG_ERROR_STD(_T("Failed to register command: ") + e.msg_);
68	} catch (...) {
69	NSC_LOG_ERROR_STD(_T("Failed to register command."));
70	}
71	return true;
72	}
73	bool CheckEventLog::unloadModule() {
74	return true;
75	}
76
77	bool CheckEventLog::hasCommandHandler() {
78	return true;
79	}
80	bool CheckEventLog::hasMessageHandler() {
81	return false;
82	}
83
84	namespace simple_registry {
85	class registry_exception {
86	std::wstring what_;
87	public:
88	registry_exception(std::wstring what) : what_(what) {}
89	registry_exception(std::wstring path, std::wstring what) : what_(path + _T(" -- ") + what) {}
90	registry_exception(std::wstring path, std::wstring key, std::wstring what) : what_(path + _T(".") + key + _T(" -- ") + what) {}
91	std::wstring what() {
92	return what_;
93	}
94	};
95	class registry_key {
96	HKEY hKey_;
97	std::wstring path_;
98	BYTE *bData_;
99	TCHAR *buffer_;
100	public:
101	registry_key(HKEY hRootKey, std::wstring path) : path_(path), hKey_(NULL), bData_(NULL), buffer_(NULL) {
102	LONG lRet = ERROR_SUCCESS;
103	if (lRet = RegOpenKeyEx(hRootKey, path.c_str(), 0, KEY_QUERY_VALUE\|KEY_READ, &hKey_) != ERROR_SUCCESS)
104	throw registry_exception(path, _T("Failed to open key: ") + error::format::from_system(lRet));
105	}
106	~registry_key() {
107	if (hKey_ != NULL)
108	RegCloseKey(hKey_);
109	delete [] bData_;
110	delete [] buffer_;
111	}
112	std::wstring get_string(std::wstring key, DWORD buffer_length = 2048) {
113	DWORD type;
114	std::wstring ret;
115	DWORD cbData = buffer_length;
116	delete [] bData_;
117	bData_ = new BYTE[cbData+2];
118	// TODO: add get size here !
119	LONG lRet = RegQueryValueEx(hKey_, key.c_str(), NULL, &type, bData_, &cbData);
120	if (lRet != ERROR_SUCCESS)
121	throw registry_exception(path_, key, _T("Failed to get value: ") + error::format::from_system(lRet));
122	if (cbData >= buffer_length \|\| cbData < 0)
123	throw registry_exception(path_, key, _T("Failed to get value: buffer to small"));
124	bData_[cbData] = 0;
125	if (type == REG_SZ) {
126	ret = reinterpret_cast<LPCTSTR>(bData_);
127	} else if (type == REG_EXPAND_SZ) {
128	std::wstring s = reinterpret_cast<LPCTSTR>(bData_);
129	delete [] buffer_;
130	buffer_ = new TCHAR[buffer_length+1];
131	DWORD expRet = ExpandEnvironmentStrings(s.c_str(), buffer_, buffer_length);
132	if (expRet >= buffer_length)
133	throw registry_exception(path_, key, _T("Buffer to small (expand)"));
134	else
135	ret = buffer_;
136	} else {
137	throw registry_exception(path_, key, _T("Unknown type (not a string)"));
138	}
139	return ret;
140	}
141	DWORD get_int(std::wstring key) {
142	DWORD type;
143	DWORD cbData = sizeof(DWORD);
144	DWORD ret = 0;
145	LONG lRet = RegQueryValueEx(hKey_, key.c_str(), NULL, &type, reinterpret_cast<LPBYTE>(&ret), &cbData);
146	if (lRet != ERROR_SUCCESS)
147	throw registry_exception(path_, key, _T("Failed to get value: ") + error::format::from_system(lRet));
148	if (type != REG_DWORD)
149	throw registry_exception(path_, key, _T("Unknown type (not a DWORD)"));
150	return ret;
151	}
152
153	std::list<std::wstring> get_keys(DWORD buffer_length = 2048) {
154	std::list<std::wstring> ret;
155	DWORD cSubKeys=0;
156	DWORD cMaxKeyLen;
157	// Get the class name and the value count.
158	LONG lRet = RegQueryInfoKey(hKey_,NULL,NULL,NULL,&cSubKeys,&cMaxKeyLen,NULL,NULL,NULL,NULL,NULL,NULL);
159	if (lRet != ERROR_SUCCESS)
160	throw registry_exception(path_, _T("Failed to query key info: ") + error::format::from_system(lRet));
161	if (cSubKeys == 0)
162	return ret;
163	delete [] buffer_;
164	buffer_ = new TCHAR[cMaxKeyLen+20];
165	for (unsigned int i=0; i<cSubKeys; i++) {
166	lRet = RegEnumKey(hKey_, i, buffer_, cMaxKeyLen+10);
167	if (lRet != ERROR_SUCCESS) {
168	throw registry_exception(path_, _T("Failed to enumerate: ") + error::lookup::last_error(lRet));
169	}
170	std::wstring str = buffer_;
171	ret.push_back(str);
172	}
173	return ret;
174	}
175
176	};
177
178	std::wstring get_string(HKEY hKey, std::wstring path, std::wstring key) {
179	registry_key reg(hKey, path);
180	return reg.get_string(key);
181	}
182	}
183
184	std::wstring find_eventlog_name(std::wstring name) {
185	try {
186	simple_registry::registry_key key(HKEY_LOCAL_MACHINE, _T("SYSTEM\\CurrentControlSet\\Services\\EventLog"));
187	std::list<std::wstring> list = key.get_keys();
188	for (std::list<std::wstring>::const_iterator cit = list.begin(); cit != list.end(); ++cit) {
189	try {
190	simple_registry::registry_key sub_key(HKEY_LOCAL_MACHINE, _T("SYSTEM\\CurrentControlSet\\Services\\EventLog\\") + *cit);
191	std::wstring file = sub_key.get_string(_T("DisplayNameFile"));
192	int id = sub_key.get_int(_T("DisplayNameID"));
193	std::wstring real_name = error::format::message::from_module(file, id);
194	strEx::replace(real_name, _T("\n"), _T(""));
195	strEx::replace(real_name, _T("\r"), _T(""));
196	if (real_name == name)
197	return *cit;
198	} catch (simple_registry::registry_exception &e) {}
199	}
200	return name;
201	} catch (simple_registry::registry_exception &e) {
202	NSC_DEBUG_MSG(_T("Failed to get eventlog name (assuming shorthand): ") + e.what());
203	return name;
204	} catch (...) {
205	NSC_DEBUG_MSG(_T("Failed to get eventlog name (assuming shorthand)"));
206	return name;
207	}
208	}
209
210	class EventLogRecord {
211	EVENTLOGRECORD *pevlr_;
212	__int64 currentTime_;
213	std::wstring file_;
214	public:
215	EventLogRecord(std::wstring file, EVENTLOGRECORD *pevlr, __int64 currentTime) : file_(file), pevlr_(pevlr), currentTime_(currentTime) {
216	}
217	inline __int64 timeGenerated() const {
218	return (currentTime_-pevlr_->TimeGenerated)*1000;
219	}
220	inline __int64 timeWritten() const {
221	return (currentTime_-pevlr_->TimeWritten)*1000;
222	}
223	inline std::wstring eventSource() const {
224	return reinterpret_cast<WCHAR*>(reinterpret_cast<LPBYTE>(pevlr_) + sizeof(EVENTLOGRECORD));
225	}
226	inline DWORD eventID() const {
227	return (pevlr_->EventID&0xffff);
228	}
229	inline DWORD severity() const {
230	return (pevlr_->EventID>>30);
231	}
232
233	inline DWORD eventType() const {
234	return pevlr_->EventType;
235	}
236	/*
237	std::wstring userSID() const {
238	if (pevlr_->UserSidOffset == 0)
239	return "";
240	PSID p = reinterpret_cast<PSID>(reinterpret_cast<LPBYTE>(pevlr_) + + pevlr_->UserSidOffset);
241	LPSTR user = new CHAR[1025];
242	LPSTR domain = new CHAR[1025];
243	DWORD userLen = 1024;
244	DWORD domainLen = 1024;
245	SID_NAME_USE sidName;
246	LookupAccountSid(NULL, p, user, &userLen, domain, &domainLen, &sidName);
247	user[userLen] = 0;
248	domain[domainLen] = 0;
249	return std::wstring(domain) + "\\" + std::wstring(user);
250	}
251	*/
252
253	std::wstring enumStrings() const {
254	std::wstring ret;
255	TCHAR* p = reinterpret_cast<TCHAR*>(reinterpret_cast<LPBYTE>(pevlr_) + pevlr_->StringOffset);
256	for (unsigned int i =0;i<pevlr_->NumStrings;i++) {
257	std::wstring s = p;
258	if (!s.empty())
259	s += _T(", ");
260	ret += s;
261	p+= wcslen(p)+1;
262	}
263	return ret;
264	}
265
266	static DWORD appendType(DWORD dwType, std::wstring sType) {
267	return dwType \| translateType(sType);
268	}
269	static DWORD subtractType(DWORD dwType, std::wstring sType) {
270	return dwType & (!translateType(sType));
271	}
272	static DWORD translateType(std::wstring sType) {
273	if (sType == _T("error"))
274	return EVENTLOG_ERROR_TYPE;
275	if (sType == _T("warning"))
276	return EVENTLOG_WARNING_TYPE;
277	if (sType == _T("info"))
278	return EVENTLOG_INFORMATION_TYPE;
279	if (sType == _T("auditSuccess"))
280	return EVENTLOG_AUDIT_SUCCESS;
281	if (sType == _T("auditFailure"))
282	return EVENTLOG_AUDIT_FAILURE;
283	return strEx::stoi(sType);
284	}
285	static std::wstring translateType(DWORD dwType) {
286	if (dwType == EVENTLOG_ERROR_TYPE)
287	return _T("error");
288	if (dwType == EVENTLOG_WARNING_TYPE)
289	return _T("warning");
290	if (dwType == EVENTLOG_INFORMATION_TYPE)
291	return _T("info");
292	if (dwType == EVENTLOG_AUDIT_SUCCESS)
293	return _T("auditSuccess");
294	if (dwType == EVENTLOG_AUDIT_FAILURE)
295	return _T("auditFailure");
296	return strEx::itos(dwType);
297	}
298	static DWORD translateSeverity(std::wstring sType) {
299	if (sType == _T("success"))
300	return 0;
301	if (sType == _T("informational"))
302	return 1;
303	if (sType == _T("warning"))
304	return 2;
305	if (sType == _T("error"))
306	return 3;
307	return strEx::stoi(sType);
308	}
309	static std::wstring translateSeverity(DWORD dwType) {
310	if (dwType == 0)
311	return _T("success");
312	if (dwType == 1)
313	return _T("informational");
314	if (dwType == 2)
315	return _T("warning");
316	if (dwType == 3)
317	return _T("error");
318	return strEx::itos(dwType);
319	}
320	std::wstring get_dll() {
321	try {
322	return simple_registry::get_string(HKEY_LOCAL_MACHINE, _T("SYSTEM\\CurrentControlSet\\Services\\EventLog\\") + file_ + (std::wstring)_T("\\") + eventSource(), _T("EventMessageFile"));
323	} catch (simple_registry::registry_exception &e) {
324	NSC_LOG_ERROR_STD(_T("Could not extract DLL for eventsource: ") + eventSource() + _T(": ") + e.what());
325	return _T("");
326	}
327	}
328
329	std::wstring render_message() {
330	DWORD *dwArgs = new DWORD[pevlr_->NumStrings+1];
331	TCHAR* p = reinterpret_cast<TCHAR*>(reinterpret_cast<LPBYTE>(pevlr_) + pevlr_->StringOffset);
332	for (unsigned int i =0;i<pevlr_->NumStrings;i++) {
333	dwArgs[i] = reinterpret_cast<DWORD>(p);
334	DWORD len = wcslen(p);
335	p += len+1;
336	}
337
338	/*
339	TCHAR _sz = (TCHAR)GlobalAlloc(GPTR, (pevlr_->NumStrings)sizeof(TCHAR ));
340	register UINT z;
341	TCHAR* p = reinterpret_cast<TCHAR*>(reinterpret_cast<LPBYTE>(pevlr_) + pevlr_->StringOffset);
342	for(unsigned int z = 0; z < pevlr_->NumStrings; z++) {
343	DWORD len = wcslen(p);
344	_sz[z] = (TCHAR )GlobalAlloc(GPTR, (len+1) sizeof(TCHAR));
345	wcscpy_s(_sz[z], len, p);
346	p += len+1;
347	}
348	*/
349	std::wstring ret;
350	strEx::splitList dlls = strEx::splitEx(get_dll(), _T(";"));
351	for (strEx::splitList::const_iterator cit = dlls.begin(); cit != dlls.end(); ++cit) {
352	//std::wstring msg = error::format::message::from_module((*cit), eventID(), _sz);
353	std::wstring msg = error::format::message::from_module((*cit), eventID(), dwArgs);
354	if (msg.empty()) {
355	msg = error::format::message::from_module((*cit), pevlr_->EventID, dwArgs);
356	}
357	strEx::replace(msg, _T("\n"), _T(" "));
358	strEx::replace(msg, _T("\t"), _T(" "));
359	std::string::size_type pos = msg.find_last_not_of(_T("\n\t "));
360	if (pos != std::string::npos) {
361	msg = msg.substr(0,pos);
362	}
363	if (!msg.empty()) {
364	if (!ret.empty())
365	ret += _T(", ");
366	ret += msg;
367	}
368	}
369	delete [] dwArgs;
370	return ret;
371	}
372	SYSTEMTIME get_time(DWORD time) {
373	FILETIME FileTime, LocalFileTime;
374	SYSTEMTIME SysTime;
375	__int64 lgTemp;
376	__int64 SecsTo1970 = 116444736000000000;
377
378	lgTemp = Int32x32To64(time,10000000) + SecsTo1970;
379
380	FileTime.dwLowDateTime = (DWORD) lgTemp;
381	FileTime.dwHighDateTime = (DWORD)(lgTemp >> 32);
382
383	FileTimeToLocalFileTime(&FileTime, &LocalFileTime);
384	FileTimeToSystemTime(&LocalFileTime, &SysTime);
385	return SysTime;
386	}
387
388	SYSTEMTIME get_time_generated() {
389	return get_time(pevlr_->TimeGenerated);
390	}
391	SYSTEMTIME get_time_written() {
392	return get_time(pevlr_->TimeWritten);
393	}
394
395	std::wstring render(bool propper, std::wstring syntax, std::wstring date_format = DATE_FORMAT) {
396	if (propper) {
397	// To obtain the appropriate message string from the message file, load the message file with the LoadLibrary function and use the FormatMessage function
398	strEx::replace(syntax, _T("%message%"), render_message());
399	} else {
400	strEx::replace(syntax, _T("%message%"), _T("%message% needs the descriptions flag set!"));
401	}
402
403	strEx::replace(syntax, _T("%source%"), eventSource());
404	strEx::replace(syntax, _T("%generated%"), strEx::format_date(get_time_generated(), date_format));
405	strEx::replace(syntax, _T("%written%"), strEx::format_date(get_time_written(), date_format));
406	strEx::replace(syntax, _T("%type%"), translateType(eventType()));
407	strEx::replace(syntax, _T("%severity%"), translateSeverity(severity()));
408	strEx::replace(syntax, _T("%strings%"), enumStrings());
409	strEx::replace(syntax, _T("%id%"), strEx::itos(eventID()));
410	return syntax;
411	}
412	};
413	/*
414	return (pevlr_->EventID&0xffff);
415	}
416	inline DWORD severity() const {
417	return (pevlr_->EventID>>30);
418	*/
419	class uniq_eventlog_record {
420	DWORD ID;
421	WORD type;
422	WORD category;
423	public:
424	std::wstring message;
425	uniq_eventlog_record(EVENTLOGRECORD *pevlr) : ID(pevlr->EventID&0xffff), type(pevlr->EventType), category(pevlr->EventCategory) {}
426	bool operator< (const uniq_eventlog_record &other) const {
427	return (ID < other.ID) \|\| ((ID==other.ID)&&(type < other.type)) \|\| (ID==other.ID&&type==other.type)&&(category < other.category);
428	}
429	std::wstring to_string() const {
430	return _T("id=") + strEx::itos(ID) + _T("type=") + strEx::itos(type) + _T("category=") + strEx::itos(category);
431	}
432	};
433	typedef std::map<uniq_eventlog_record,unsigned int> uniq_eventlog_map;
434
435
436	struct eventlog_filter {
437	filters::filter_all_strings eventSource;
438	filters::filter_all_numeric<unsigned int, filters::handlers::eventtype_handler> eventType;
439	filters::filter_all_numeric<unsigned int, filters::handlers::eventseverity_handler> eventSeverity;
440	filters::filter_all_strings message;
441	filters::filter_all_times timeWritten;
442	filters::filter_all_times timeGenerated;
443	filters::filter_all_numeric<DWORD, filters::handlers::eventtype_handler> eventID;
444	std::wstring value_;
445
446	inline bool hasFilter() {
447	return eventSource.hasFilter() \|\| eventType.hasFilter() \|\| eventID.hasFilter() \|\| eventSeverity.hasFilter() \|\| message.hasFilter() \|\|
448	timeWritten.hasFilter() \|\| timeGenerated.hasFilter();
449	}
450	std::wstring getValue() const {
451	if (eventSource.hasFilter())
452	return _T("event-source: ") + eventSource.getValue();
453	if (eventType.hasFilter())
454	return _T("event-type: ") + eventType.getValue();
455	if (eventSeverity.hasFilter())
456	return _T("severity: ") + eventSeverity.getValue();
457	if (eventID.hasFilter())
458	return _T("event-id: ") + eventID.getValue();
459	if (message.hasFilter())
460	return _T("message: ") + message.getValue();
461	if (timeWritten.hasFilter())
462	return _T("time-written: ") + timeWritten.getValue();
463	if (timeGenerated.hasFilter())
464	return _T("time-generated: ") + timeGenerated.getValue();
465	return _T("UNknown...");
466	}
467	bool matchFilter(const EventLogRecord &value) const {
468	if ((eventSource.hasFilter())&&(eventSource.matchFilter(value.eventSource())))
469	return true;
470	else if ((eventType.hasFilter())&&(eventType.matchFilter(value.eventType())))
471	return true;
472	else if ((eventSeverity.hasFilter())&&(eventSeverity.matchFilter(value.severity())))
473	return true;
474	else if ((eventID.hasFilter())&&(eventID.matchFilter(value.eventID())))
475	return true;
476	else if ((message.hasFilter())&&(message.matchFilter(value.enumStrings())))
477	return true;
478	else if ((timeWritten.hasFilter())&&(timeWritten.matchFilter(value.timeWritten())))
479	return true;
480	else if ((timeGenerated.hasFilter())&&(timeGenerated.matchFilter(value.timeGenerated())))
481	return true;
482	return false;
483	}
484	};
485
486
487	#define MAP_FILTER(value, obj, filtermode) \
488	else if (p__.first == value) { eventlog_filter filter; filter.obj = p__.second; filter_chain.push_back(filteritem_type(filtermode, filter)); }
489
490	struct event_log_buffer {
491	BYTE *bBuffer;
492	DWORD bufferSize_;
493	event_log_buffer(DWORD bufferSize) : bufferSize_(bufferSize) {
494	bBuffer = new BYTE[bufferSize+10];
495	}
496	~event_log_buffer() {
497	delete [] bBuffer;
498	}
499	EVENTLOGRECORD* getBufferUnsafe() {
500	return reinterpret_cast<EVENTLOGRECORD*>(bBuffer);
501	}
502	DWORD getBufferSize() {
503	return bufferSize_;
504	}
505	};
506
507	NSCAPI::nagiosReturn CheckEventLog::handleCommand(const strEx::blindstr command, const unsigned int argLen, TCHAR **char_args, std::wstring &message, std::wstring &perf) {
508	if (command != _T("CheckEventLog"))
509	return NSCAPI::returnIgnored;
510	typedef checkHolders::CheckContainer<checkHolders::MaxMinBoundsULongInteger> EventLogQueryContainer;
511	typedef std::pair<int,eventlog_filter> filteritem_type;
512	typedef std::list<filteritem_type > filterlist_type;
513	NSCAPI::nagiosReturn returnCode = NSCAPI::returnOK;
514	std::list<std::wstring> stl_args = arrayBuffer::arrayBuffer2list(argLen, char_args);
515
516	std::list<std::wstring> files;
517	filterlist_type filter_chain;
518	EventLogQueryContainer query;
519
520	bool bPerfData = true;
521	bool bFilterIn = true;
522	bool bFilterAll = false;
523	bool bFilterNew = true;
524	bool bShowDescriptions = false;
525	bool unique = false;
526	unsigned int truncate = 0;
527	std::wstring syntax = syntax_;
528	const int filter_plus = 1;
529	const int filter_minus = 2;
530	const int filter_normal = 3;
531	const int filter_compat = 3;
532	event_log_buffer buffer(buffer_);
533
534	try {
535	MAP_OPTIONS_BEGIN(stl_args)
536	MAP_OPTIONS_NUMERIC_ALL(query, _T(""))
537	MAP_OPTIONS_STR2INT(_T("truncate"), truncate)
538	MAP_OPTIONS_BOOL_TRUE(_T("unique"), unique)
539	MAP_OPTIONS_BOOL_TRUE(_T("descriptions"), bShowDescriptions)
540	MAP_OPTIONS_PUSH(_T("file"), files)
541	MAP_OPTIONS_BOOL_FALSE(IGNORE_PERFDATA, bPerfData)
542	MAP_OPTIONS_BOOL_EX(_T("filter"), bFilterNew, _T("new"), _T("old"))
543	MAP_OPTIONS_BOOL_EX(_T("filter"), bFilterIn, _T("in"), _T("out"))
544	MAP_OPTIONS_BOOL_EX(_T("filter"), bFilterAll, _T("all"), _T("any"))
545	MAP_OPTIONS_STR(_T("syntax"), syntax)
546	/*
547	MAP_FILTER_OLD("filter-eventType", eventType)
548	MAP_FILTER_OLD("filter-severity", eventSeverity)
549	MAP_FILTER_OLD("filter-eventID", eventID)
550	MAP_FILTER_OLD("filter-eventSource", eventSource)
551	MAP_FILTER_OLD("filter-generated", timeGenerated)
552	MAP_FILTER_OLD("filter-written", timeWritten)
553	MAP_FILTER_OLD("filter-message", message)
554	*/
555	MAP_FILTER(_T("filter+eventType"), eventType, filter_plus)
556	MAP_FILTER(_T("filter+severity"), eventSeverity, filter_plus)
557	MAP_FILTER(_T("filter+eventID"), eventID, filter_plus)
558	MAP_FILTER(_T("filter+eventSource"), eventSource, filter_plus)
559	MAP_FILTER(_T("filter+generated"), timeGenerated, filter_plus)
560	MAP_FILTER(_T("filter+written"), timeWritten, filter_plus)
561	MAP_FILTER(_T("filter+message"), message, filter_plus)
562
563	MAP_FILTER(_T("filter.eventType"), eventType, filter_normal)
564	MAP_FILTER(_T("filter.severity"), eventSeverity, filter_normal)
565	MAP_FILTER(_T("filter.eventID"), eventID, filter_normal)
566	MAP_FILTER(_T("filter.eventSource"), eventSource, filter_normal)
567	MAP_FILTER(_T("filter.generated"), timeGenerated, filter_normal)
568	MAP_FILTER(_T("filter.written"), timeWritten, filter_normal)
569	MAP_FILTER(_T("filter.message"), message, filter_normal)
570
571	MAP_FILTER(_T("filter-eventType"), eventType, filter_minus)
572	MAP_FILTER(_T("filter-severity"), eventSeverity, filter_minus)
573	MAP_FILTER(_T("filter-eventID"), eventID, filter_minus)
574	MAP_FILTER(_T("filter-eventSource"), eventSource, filter_minus)
575	MAP_FILTER(_T("filter-generated"), timeGenerated, filter_minus)
576	MAP_FILTER(_T("filter-written"), timeWritten, filter_minus)
577	MAP_FILTER(_T("filter-message"), message, filter_minus)
578
579	MAP_OPTIONS_MISSING(message, _T("Unknown argument: "))
580	MAP_OPTIONS_END()
581	} catch (filters::parse_exception e) {
582	message = e.getMessage();
583	return NSCAPI::returnUNKNOWN;
584	} catch (filters::filter_exception e) {
585	message = e.getMessage();
586	return NSCAPI::returnUNKNOWN;
587	}
588
589	unsigned long int hit_count = 0;
590	if (files.empty()) {
591	message = _T("No file specified try adding: file=Application");
592	return NSCAPI::returnUNKNOWN;
593	}
594
595	for (std::list<std::wstring>::const_iterator cit2 = files.begin(); cit2 != files.end(); ++cit2) {
596	std::wstring name = *cit2;
597	if (lookup_names_) {
598	name = find_eventlog_name(*cit2);
599	if ((*cit2) != name) {
600	NSC_DEBUG_MSG_STD(_T("Opening alternative log: ") + name);
601	}
602	}
603	HANDLE hLog = OpenEventLog(NULL, name.c_str());
604	if (hLog == NULL) {
605	message = _T("Could not open the '") + (*cit2) + _T("' event log: ") + error::lookup::last_error();
606	return NSCAPI::returnUNKNOWN;
607	}
608	uniq_eventlog_map uniq_records;
609
610	//DWORD dwThisRecord;
611	DWORD dwRead, dwNeeded;
612
613
614	__time64_t ltime;
615	_time64(&ltime);
616
617	//GetOldestEventLogRecord(hLog, &dwThisRecord);
618
619	while (ReadEventLog(hLog, EVENTLOG_FORWARDS_READ\|EVENTLOG_SEQUENTIAL_READ,
620	0, buffer.getBufferUnsafe(), buffer.getBufferSize(), &dwRead, &dwNeeded))
621	{
622	EVENTLOGRECORD *pevlr = buffer.getBufferUnsafe();
623	while (dwRead > 0) {
624	//bool bMatch = bFilterAll;
625	bool bMatch = !bFilterIn;
626	EventLogRecord record((*cit2), pevlr, ltime);
627
628	if (filter_chain.empty()) {
629	message = _T("No filters specified try adding: filter+generated=>2d");
630	return NSCAPI::returnUNKNOWN;
631	}
632
633
634	for (filterlist_type::const_iterator cit3 = filter_chain.begin(); cit3 != filter_chain.end(); ++cit3 ) {
635	std::wstring reason;
636	int mode = (*cit3).first;
637	bool bTmpMatched = (*cit3).second.matchFilter(record);
638	if (!bFilterNew) {
639	if (bFilterAll) {
640	if (!bTmpMatched) {
641	bMatch = false;
642	break;
643	}
644	} else {
645	if (bTmpMatched) {
646	bMatch = true;
647	break;
648	}
649	}
650	} else {
651	if ((mode == filter_minus)&&(bTmpMatched)) {
652	// a -<filter> hit so thrash item and bail out!
653	if (debug_)
654	NSC_DEBUG_MSG_STD(_T("Matched: - ") + (*cit3).second.getValue() + _T(" for: ") + record.render(bShowDescriptions, syntax));
655	bMatch = false;
656	break;
657	} else if ((mode == filter_plus)&&(!bTmpMatched)) {
658	// a +<filter> missed hit so thrash item and bail out!
659	if (debug_)
660	NSC_DEBUG_MSG_STD(_T("Matched: + ") + (*cit3).second.getValue() + _T(" for: ") + record.render(bShowDescriptions, syntax));
661	bMatch = false;
662	break;
663	} else if (bTmpMatched) {
664	if (debug_)
665	NSC_DEBUG_MSG_STD(_T("Matched: . (contiunue): ") + (*cit3).second.getValue() + _T(" for: ") + record.render(bShowDescriptions, syntax));
666	bMatch = true;
667	}
668	}
669	}
670	bool match = false;
671	if ((!bFilterNew)&&((bFilterIn&&bMatch)\|\|(!bFilterIn&&!bMatch))) {
672	match = true;
673	} else if (bFilterNew&&bMatch) {
674	match = true;
675	}
676	if (match&&unique) {
677	match = false;
678	uniq_eventlog_record uniq_record = pevlr;
679	uniq_eventlog_map::iterator it = uniq_records.find(uniq_record);
680	if (it != uniq_records.end()) {
681	(*it).second ++;
682	//match = false;
683	}
684	else {
685	if (!syntax.empty()) {
686	uniq_record.message = record.render(bShowDescriptions, syntax);
687	} else if (!bShowDescriptions) {
688	uniq_record.message = record.eventSource();
689	} else {
690	uniq_record.message = record.eventSource();
691	uniq_record.message += _T("(") + EventLogRecord::translateType(record.eventType()) + _T(", ") +
692	strEx::itos(record.eventID()) + _T(", ") + EventLogRecord::translateSeverity(record.severity()) + _T(")");
693	uniq_record.message += _T("[") + record.enumStrings() + _T("]");
694	uniq_record.message += _T("{%count%}");
695	}
696	uniq_records[uniq_record] = 1;
697	}
698	hit_count++;
699	} else if (match) {
700	if (!syntax.empty()) {
701	strEx::append_list(message, record.render(bShowDescriptions, syntax));
702	} else if (!bShowDescriptions) {
703	strEx::append_list(message, record.eventSource());
704	} else {
705	strEx::append_list(message, record.eventSource());
706	message += _T("(") + EventLogRecord::translateType(record.eventType()) + _T(", ") +
707	strEx::itos(record.eventID()) + _T(", ") + EventLogRecord::translateSeverity(record.severity()) + _T(")");
708	message += _T("[") + record.enumStrings() + _T("]");
709	}
710	hit_count++;
711	}
712	dwRead -= pevlr->Length;
713	pevlr = reinterpret_cast<EVENTLOGRECORD*>((LPBYTE)pevlr + pevlr->Length);
714	}
715	}
716	DWORD err = GetLastError();
717	if (err == ERROR_INSUFFICIENT_BUFFER) {
718	NSC_LOG_ERROR_STD(_T("EvenlogBuffer is too small (set the value of ") + settings::event_log::BUFFER_SIZE_TITLE + _T("): ") + error::lookup::last_error(err));
719	message = std::wstring(_T("EvenlogBuffer is too small (set the value of ")) + settings::event_log::BUFFER_SIZE_TITLE + _T("): ") + error::lookup::last_error(err);
720	return NSCAPI::returnUNKNOWN;
721	} else if (err != ERROR_HANDLE_EOF) {
722	NSC_LOG_ERROR_STD(_T("Failed to read from eventlog: ") + error::lookup::last_error(err));
723	message = _T("Failed to read from eventlog: ") + error::lookup::last_error(err);
724	return NSCAPI::returnUNKNOWN;
725	}
726	CloseEventLog(hLog);
727	for (uniq_eventlog_map::const_iterator cit = uniq_records.begin(); cit != uniq_records.end(); ++cit) {
728	std::wstring msg = (*cit).first.message;
729	strEx::replace(msg, _T("%count%"), strEx::itos((*cit).second));
730	strEx::append_list(message, msg);
731	}
732	}
733
734	if (!bPerfData)
735	query.perfData = false;
736	if (query.alias.empty())
737	query.alias = _T("eventlog");
738	query.runCheck(hit_count, returnCode, message, perf);
739	if ((truncate > 0) && (message.length() > (truncate-4)))
740	message = message.substr(0, truncate-4) + _T("...");
741	if (message.empty())
742	message = _T("Eventlog check ok");
743	NSC_DEBUG_MSG_STD(_T("Result: ") + message) ;
744	return returnCode;
745	}
746
747
748	NSC_WRAPPERS_MAIN_DEF(gCheckEventLog);
749	NSC_WRAPPERS_IGNORE_MSG_DEF();
750	NSC_WRAPPERS_HANDLE_CMD_DEF(gCheckEventLog);

Note: See TracBrowser for help on using the repository browser.

Download in other formats: