Class: Fluent::Plugin::WinevtXMLparser

Inherits:
Parser
  • Object
show all
Defined in:
lib/fluent/plugin/parser_winevt_xml.rb

Instance Method Summary collapse

Constructor Details

#initialize ⇒ WinevtXMLparser

Returns a new instance of WinevtXMLparser.



10
11
12
13
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 10

def initialize
  super
  @use_nokogiri = false
end

Instance Method Details

#configure(conf) ⇒ Object 



15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 15

def configure(conf)
  super
  if @parser != :rexml
    begin
      require 'nokogiri'
      @use_nokogiri = true
    rescue
      if @parser == :nokogiri
        raise Fluent::ConfigError,
              "Nokogiri is required when 'parser nokogiri' is specified, but it isn't installed. " \
              "Install nokogiri, or set 'parser' to 'rexml' or 'auto': #{e.message}"
      end
    end
  end

  if !@use_nokogiri
    require 'rexml/document'
  end
end

#event_id_nokogiri(system_elem) ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 47

def event_id_nokogiri(system_elem)
  if @preserve_qualifiers
    return ((system_elem/'EventID').text rescue nil)
  end

  qualifiers = (system_elem/'EventID').attribute("Qualifiers").text rescue nil
  if qualifiers
    event_id = (system_elem/'EventID').text
    event_id = MAKELONG(event_id.to_i, qualifiers.to_i)
    event_id.to_s
  else
    (system_elem/'EventID').text rescue nil
  end
end

#event_id_rexml(system_elem) ⇒ Object 



62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 62

def event_id_rexml(system_elem)
  return system_elem.elements['EventID'].text rescue nil if @preserve_qualifiers

  qualifiers = system_elem.elements['EventID'].attributes['Qualifiers'] rescue nil
  if qualifiers
    event_id = system_elem.elements['EventID'].text
    event_id = MAKELONG(event_id.to_i, qualifiers.to_i)
    event_id.to_s
  else
    system_elem.elements['EventID'].text rescue nil
  end
end

#MAKELONG(low, high) ⇒ Object 



43
44
45
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 43

def MAKELONG(low, high)
  (low & 0xffff) | (high & 0xffff) << 16
end

#parse(text) {|time, record| ... } ⇒ Object

Yields:

  • (time, record) 


131
132
133
134
135
136
137
138
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 131

def parse(text)
  if @use_nokogiri
    time, record = parse_nokogiri(text)
  else
    time, record = parse_rexml(text)
  end
  yield time, record
end

#parse_nokogiri(text) ⇒ Object 



75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 75

def parse_nokogiri(text)
  record = {}
  doc = Nokogiri::XML(text)
  system_elem                     = doc/'Event'/'System'
  record["ProviderName"]          = (system_elem/"Provider").attribute("Name").text rescue nil
  record["ProviderGUID"]          = (system_elem/"Provider").attribute("Guid").text rescue nil
  if @preserve_qualifiers
    record["Qualifiers"]          = (system_elem/'EventID').attribute("Qualifiers").text rescue nil
  end
  record["EventID"]               = event_id_nokogiri(system_elem)
  record["Level"]                 = (system_elem/'Level').text rescue nil
  record["Task"]                  = (system_elem/'Task').text rescue nil
  record["Opcode"]                = (system_elem/'Opcode').text rescue nil
  record["Keywords"]              = (system_elem/'Keywords').text rescue nil
  record["TimeCreated"]           = (system_elem/'TimeCreated').attribute("SystemTime").text rescue nil
  record["EventRecordID"]         = (system_elem/'EventRecordID').text rescue nil
  record["ActivityID"]            = (system_elem/'Correlation').attribute('ActivityID').text rescue nil
  record["RelatedActivityID"]     = (system_elem/'Correlation').attribute("RelatedActivityID").text rescue nil
  record["ThreadID"]              = (system_elem/'Execution').attribute("ThreadID").text rescue nil
  record["ProcessID"]             = (system_elem/'Execution').attribute("ProcessID").text rescue nil
  record["Channel"]               = (system_elem/'Channel').text rescue nil
  record["Computer"]              = (system_elem/"Computer").text rescue nil
  record["UserID"]                = (system_elem/'Security').attribute("UserID").text rescue nil
  record["Version"]               = (system_elem/'Version').text rescue nil
  time = @estimate_current_event ? Fluent::EventTime.now : nil
  return time, record
end

#parse_rexml(text) ⇒ Object 



103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 103

def parse_rexml(text)
  record = {}
  doc = REXML::Document.new(text)
  system_elem = doc.root.elements['System'] rescue nil
  record["ProviderName"]      = system_elem.elements['Provider'].attributes['Name'] rescue nil
  record["ProviderGUID"]      = system_elem.elements['Provider'].attributes['Guid'] rescue nil
  if @preserve_qualifiers
    record["Qualifiers"]      = system_elem.elements['EventID'].attributes['Qualifiers'] rescue nil
  end
  record["EventID"]           = event_id_rexml(system_elem)
  record["Level"]             = system_elem.elements['Level'].text rescue nil
  record["Task"]              = system_elem.elements['Task'].text rescue nil
  record["Opcode"]            = system_elem.elements['Opcode'].text rescue nil
  record["Keywords"]          = system_elem.elements['Keywords'].text rescue nil
  record["TimeCreated"]       = system_elem.elements['TimeCreated'].attributes['SystemTime'] rescue nil
  record["EventRecordID"]     = system_elem.elements['EventRecordID'].text rescue nil
  record["ActivityID"]        = system_elem.elements['Correlation'].attributes['ActivityID'] rescue nil
  record["RelatedActivityID"] = system_elem.elements['Correlation'].attributes['RelatedActivityID'] rescue nil
  record["ThreadID"]          = system_elem.elements['Execution'].attributes['ThreadID'] rescue nil
  record["ProcessID"]         = system_elem.elements['Execution'].attributes['ProcessID'] rescue nil
  record["Channel"]           = system_elem.elements['Channel'].text rescue nil
  record["Computer"]          = system_elem.elements['Computer'].text rescue nil
  record["UserID"]            = system_elem.elements['Security'].attributes['UserID'] rescue nil
  record["Version"]           = system_elem.elements['Version'].text rescue nil
  time = @estimate_current_event ? Fluent::EventTime.now : nil
  return time, record
end

#preserve_qualifiers? ⇒ Boolean

Returns:

  • (Boolean) 


39
40
41
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 39

def preserve_qualifiers?
  @preserve_qualifiers
end

#winevt_xml? ⇒ Boolean

Returns:

  • (Boolean) 


35
36
37
 
# File 'lib/fluent/plugin/parser_winevt_xml.rb', line 35

def winevt_xml?
  true
end