-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
x-pack/libbeat/reader/etw: New reader to collect ETW logs #36914
Conversation
This pull request does not have a backport label.
To fixup this pull request, you need to add the backport labels for the needed
|
💔 Build Failed
Expand to view the summary
Build stats
Test stats 🧪
Steps errorsExpand to view the steps failures
|
This pull request is now in conflicts. Could you fix it? 🙏
|
260d4e9
to
e0d0384
Compare
❕ Build Aborted
Expand to view the summary
Build stats
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
bc1149d
to
7d102a2
Compare
❕ Build Aborted
Expand to view the summary
Build stats
Test stats 🧪
Test errorsExpand to view the tests failures
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- Review what is exported. If users of the package don't need the type then it should not be exported. The extra stuff in the godocs makes it harder to see the signal through the noise. Extra exported types can also make future refactoring harder since you don't know who might be relying on exported types.
- Reuse existing types and functions from https://pkg.go.dev/golang.org/x/sys/windows wherever possible. It's less code for us to maintain and test.
@chemamartinez are you planning to take of this PR soon or should we put in back to draft for now? |
@pierrehilbert yes, I am currently working on it. |
Thanks for the update, just wanted to confirm that was still under your radar |
This pull request is now in conflicts. Could you fix it? 🙏
|
❕ Build Aborted
Expand to view the summary
Build stats
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
💔 Build Failed
Expand to view the summary
Build stats
Pipeline error
❕ Flaky test reportNo test was executed to be analysed. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
💚 Build Succeeded
Expand to view the summary
Build stats
❕ Flaky test reportNo test was executed to be analysed. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
💚 Build Succeeded
Expand to view the summary
Build stats
❕ Flaky test reportNo test was executed to be analysed. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
This pull request does not have a backport label.
To fixup this pull request, you need to add the backport labels for the needed
|
/test |
💔 Build Failed
Failed CI StepsHistory
|
Failed CI tests are related to the migration to Buildkite, unrelated to any change in this PR. |
Description
This PR adds support for reading and parsing Microsoft ETW (Event Tracing for Windows) events. It is implemented as a library in Libbeat which contains:
syscall_advapi32.go
: All the needed headers and syscalls to comunicate with the Advapi32 Windows API. Syscalls from Advapi32 are needed to control ETW sessions and consume events. More information at https://learn.microsoft.com/en-us/windows/win32/api/evntrace/.syscall_tdh.go
: All the needed headers and syscalls to comunicate with the TDH Windows API. It is mainly used for the processing of ETW read events. More information can be found at https://learn.microsoft.com/en-us/windows/win32/api/tdh/.session.go
andcontroller.go
: They are in charge of creating, querying, and stopping sessions.provider.go
: Helpers for handling the translation between providers name and GUID.consumer.go
: Once we have a valid session or a logfile, the consumer starts the read of ETW events.event.go
: Uses the TDH Windows API to process and parse ETW events. It also contains a default implementation of the callbacks that receive ETW events. However, this callback can be overwritten for particular use cases.The ETW reader provides the following config options:
logman query providers
to list the available providers.logman query providers
to list the available providers.logman query -ets
.These options above are mutually exclusive.
logman query -ets
.critical
,error
,warning
,informational
, andverbose
.This library is compiled exclusively for Windows, as it is based on the Windows API and some other Windows helper packages. This is why this pull request also enables Windows unit tests for Libbeat.
This pull request is followed by #36915 where a Filebeat input is created to interact with this library and allow users to ingest ETW events through Filebeat or future integrations.
Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Author's Checklist
How to test this PR locally
This pull request cannot be tested since it only contains the internal package to collect and process ETW events. It can be manually tested via #36915.
Related issues