[checkmk-commits] 6191 FIX Configure additional Windows eventlogs with keyword 'logfile'

Module: check_mk Branch: master Commit: 4e2a753d420bf1ebb921c078eb38eb90bc4b6ce4 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=4e2a753d420bf1… Author: Jukka Aro &lt;ja(a)mathias-kettner.de&gt; Date: Tue Jun 26 16:06:32 2018 +0200 6191 FIX Configure additional Windows eventlogs with keyword 'logfile' Werk #3106 (Check_MK 1.4.0i1) introduced the possibility of configuring additional eventlogs with the keyword 'logname'. However, this was not supported by the Agent Bakery that only knew the keyword 'logfile'. Now, additional, non-standard eventlogs that are not found in Windows registry, can be configured for monitoring with the ordinary keyword 'logfile', e.g. "logfile Microsoft-Windows-GroupPolicy/Operational = warn" so that they can also be configured normally through the Agent Bakery. Note that non-standard eventlogs also require the option vista_api to be set to 'yes.' Using the keyword 'logname' is strongly discouraged and that keyword should be considered deprecated. It will remain functional only for compatibility with old, manually configured check_mk.ini files. Change-Id: I158a212746468041ce34f719cc0b4d5598b23eae --- .werks/6191 | 26 ++++++++++++++++++++++++++ agents/windows/build_version | 2 +- agents/windows/check_mk.example.ini | 12 ++++++------ agents/windows/sections/SectionEventlog.cc | 17 ++++++++--------- agents/windows/sections/SectionEventlog.h | 9 +++------ 5 files changed, 44 insertions(+), 22 deletions(-) diff --git a/.werks/6191 b/.werks/6191 new file mode 100644 index 0000000..a5c82d4 --- /dev/null +++ b/.werks/6191 @@ -0,0 +1,26 @@ +Title: Configure additional Windows eventlogs with keyword 'logfile' +Level: 2 +Component: checks +Compatible: compat +Edition: cre +Version: 1.6.0i1 +Date: 1530020759 +Class: fix + +Werk #3106 (Check_MK 1.4.0i1) introduced the possibility of configuring +additional eventlogs with the keyword 'logname'. However, this was not +supported by the Agent Bakery that only knew the keyword 'logfile'. + +Now, additional, non-standard eventlogs that are not found in Windows +registry, can be configured for monitoring with the ordinary keyword +'logfile', e.g. +"logfile Microsoft-Windows-GroupPolicy/Operational = warn" +so that they can also be configured normally through the Agent Bakery. +Note that non-standard eventlogs also require the option vista_api to +be set to 'yes.' + +Using the keyword 'logname' is strongly discouraged and that keyword +should be considered deprecated. It will remain functional only for +compatibility with old, manually configured check_mk.ini files. + + diff --git a/agents/windows/build_version b/agents/windows/build_version index 49f2b70..f5192e7 100644 --- a/agents/windows/build_version +++ b/agents/windows/build_version @@ -1 +1 @@ -3256 +3258 diff --git a/agents/windows/check_mk.example.ini b/agents/windows/check_mk.example.ini index ae7addc..8bf57b7 100644 --- a/agents/windows/check_mk.example.ini +++ b/agents/windows/check_mk.example.ini @@ -115,8 +115,8 @@ # activate modern eventlog api introduced in vista # pro: supports new logs introduced with vista # contra: only on vista (server 2008) and newer, less well tested, maybe slower - # Note: setting this does not change the default set of monitored logs, - # see logname for that + # Note: setting this does not change the default set of monitored logs that + # are found in Windows registry. # vista_api = yes # Testing: output *all* messages from the eventlogs @@ -133,12 +133,12 @@ # send messages of type warn or crit # logfile * = off - # Activate a specific log. Unlike logfile this can be used to activate - # monitoring of a new-style logfile (see vista_api) but it doesn't - # support wildcards (yet). + # Activate a specific log. Requires vista_api = yes. This can be used to + # activate the monitoring of a log not found in Windows registry. Note: + # wildcards only work with standard logs that are found in Windows registry. # To find the correct name for a log, right-click on the log in # event-viewer -> Properties and use the name from "Full Name" - # logname Microsoft-Windows-GroupPolicy/Operational = warn + # logfile Microsoft-Windows-GroupPolicy/Operational = warn [mrpe] # Run classical monitoring plugins. The word before the command diff --git a/agents/windows/sections/SectionEventlog.cc b/agents/windows/sections/SectionEventlog.cc index 2e8335d..23c5360 100644 --- a/agents/windows/sections/SectionEventlog.cc +++ b/agents/windows/sections/SectionEventlog.cc @@ -218,7 +218,7 @@ eventlog::config from_string<eventlog::config>(const WinApiInterface &, } } - return eventlog::config("", level, hide_context, false); + return eventlog::config("", level, hide_context); } namespace eventlog { @@ -257,7 +257,6 @@ void Configurable::feed(const std::string &var, const std::string &value) { } entry.name = join(std::next(tokens.cbegin()), tokens.cend(), " "); - entry.vista_api = (tokens[0] == "logname"); add(entry); } @@ -371,13 +370,11 @@ FindResult SectionEventlog::findLog(const HKeyHandle &hKey, DWORD index) const { buffer.data()}; } -void SectionEventlog::registerVistaStyleLogs(eventlog::States &states) { - // enable the vista-style logs if that api is enabled +void SectionEventlog::registerAdditionalEventlogs(eventlog::States &states) { + // if vista API enabled, register additional configured logs not in registry if (*_vista_api) { for (const auto &eventlog : *_config) { - if (eventlog.vista_api) { - registerEventlog(eventlog.name, *_sendall, states); - } + registerEventlog(eventlog.name, *_sendall, states); } } } @@ -386,6 +383,7 @@ void SectionEventlog::registerVistaStyleLogs(eventlog::States &states) { event logs are available. */ bool SectionEventlog::find_eventlogs(std::ostream &out, eventlog::States &states) { + // 1) Find and register ordinary event logs found in registry. const std::string regpath{"SYSTEM\\CurrentControlSet\\Services\\Eventlog"}; HKEY key = nullptr; bool success = true; @@ -406,8 +404,9 @@ bool SectionEventlog::find_eventlogs(std::ostream &out, out << "ERROR: Cannot open registry key " << regpath << " for enumeration: error code " << lastError << "\n"; } - - registerVistaStyleLogs(states); + // 2) Register additional, configured logs that are not in registry. + // Note: only supported with vista API enabled. + registerAdditionalEventlogs(states); return success; } diff --git a/agents/windows/sections/SectionEventlog.h b/agents/windows/sections/SectionEventlog.h index cadbf3c..70a751e 100644 --- a/agents/windows/sections/SectionEventlog.h +++ b/agents/windows/sections/SectionEventlog.h @@ -39,17 +39,14 @@ std::ostream &operator<<(std::ostream &os, const Level &l); // Configuration entries from [logwatch] for individual logfiles struct config { - config(const std::string &name, Level level, bool hide_context, - bool vista_api) + config(const std::string &name, Level level, bool hide_context) : name(name) , level(level) - , hide_context(hide_context) - , vista_api(vista_api) {} + , hide_context(hide_context) {} std::string name; Level level; bool hide_context; - bool vista_api; }; std::ostream &operator<<(std::ostream &out, const config &val); @@ -108,7 +105,7 @@ private: uint64_t previouslyReadId, eventlog::Level level, bool hideContext); FindResult findLog(const HKeyHandle &hKey, DWORD index) const; - void registerVistaStyleLogs(eventlog::States &states); + void registerAdditionalEventlogs(eventlog::States &states); bool find_eventlogs(std::ostream &out, eventlog::States &states); void saveEventlogOffsets(const std::string &statefile, const eventlog::States &states);