fix to unblock Event Log Failure in ltcs 2019 image

microsoft · Sep 13, 2023 · b061bce · b061bce
1 parent 8735dc0
commit b061bce
Show file tree

Hide file tree

Showing 2 changed files with 151 additions and 5 deletions.
diff --git a/LogMonitor/src/LogMonitor/EventMonitor.cpp b/LogMonitor/src/LogMonitor/EventMonitor.cpp
@@ -599,18 +599,152 @@ EventMonitor::EnableEventLogChannels()
 {
     for (const auto& eventChannel : m_eventChannels)
     {
-        EnableEventLogChannel(eventChannel.Name.c_str());
+        DWORD status = EnableEventLogChannel(eventChannel.Name.c_str());
+
+        if (status == RPC_S_SERVER_UNAVAILABLE) {
+
+            HANDLE timerEvent = CreateWaitableTimer(NULL, FALSE, NULL);
+
+
+            if (!timerEvent) {
+            status = GetLastError();
+            logWriter.TraceError(
+                Utility::FormatString(
+                    L"Failed to create timer object.", status).c_str());
+                        }
+
+            std::double_t waitInSeconds = 300;
+
+            int elapsedTime = 0;
+
+            const int eventsCount = 2;
+            HANDLE dirOpenEvents[eventsCount] = {m_stopEvent, timerEvent};
+
+            while (elapsedTime < waitInSeconds) {
+
+                int waitInterval = EventMonitor::_GetWaitInterval(waitInSeconds, elapsedTime);
+                LARGE_INTEGER timeToWait = EventMonitor::_ConvertWaitIntervalToLargeInt(waitInterval);
+
+                BOOL waitableTimer = SetWaitableTimer(timerEvent, &timeToWait, 0, NULL, NULL, 0);
+                if (!waitableTimer) {
+                    status = GetLastError();
+                    logWriter.TraceError(
+                        Utility::FormatString(
+                            L"Failed to set timer object to enable %s event channel. Error: %lu",
+                            eventChannel.Name.c_str(),
+                            status).c_str());
+                    break;
+                }
+
+                DWORD wait = WaitForMultipleObjects(eventsCount, dirOpenEvents, FALSE, INFINITE);
+                switch(wait)
+                {
+                    case WAIT_OBJECT_0:
+                    {
+                        //
+                        // The process is exiting. Stop the timer and return.
+                        //
+                        CancelWaitableTimer(timerEvent);
+                        CloseHandle(timerEvent);
+                        // return INVALID_HANDLE_VALUE;
+                    }
+
+                    case WAIT_OBJECT_0 + 1:
+                    {
+                        //
+                        // Timer event. Retry opening directory handle.
+                        //
+                        break;
+                    }
+
+                    default:
+                    {
+                        //
+                        // Wait failed, return the failure.
+                        //
+                        status = GetLastError();
+
+                        CancelWaitableTimer(timerEvent);
+                        CloseHandle(timerEvent);
+
+                    }
+                }
+
+                DWORD status = EnableEventLogChannel(eventChannel.Name.c_str());
+
+                if (status == RPC_S_SERVER_UNAVAILABLE)
+                {
+                    elapsedTime += WAIT_INTERVAL;
+                }
+                else
+                {
+                    logWriter.TraceInfo(
+                        Utility::FormatString(
+                            L"Enabled %s event channel after %d seconds.",
+                            eventChannel.Name.c_str(),
+                            elapsedTime).c_str()
+                    );
+                    status = ERROR_SUCCESS;
+                    break;
+                }
+
+            }
+
+            CancelWaitableTimer(timerEvent);
+            CloseHandle(timerEvent);
+
+            if(elapsedTime < waitInSeconds) 
+        {
+            logWriter.TraceError(
+            Utility::FormatString(
+                L"Failed to enable event channel. Channel: %ws Error: 0x%X",
+                eventChannel.Name.c_str(),
+                status
+            ).c_str()
+        );
+        }
+
+        }
+
+
+
     }
 }
 
 
+// Converts the time to wait to a large integer
+LARGE_INTEGER EventMonitor::_ConvertWaitIntervalToLargeInt(int timeInterval)
+{
+    LARGE_INTEGER liDueTime{};
+
+    int millisecondsToWait = timeInterval * 1000;
+    liDueTime.QuadPart = -millisecondsToWait * 10000LL; // wait time in 100 nanoseconds
+    return liDueTime;
+}
+
+// Returns the time (in seconds) to wait based on the specified waitInSeconds
+int EventMonitor::_GetWaitInterval(std::double_t waitInSeconds, int elapsedTime)
+{
+    if (isinf(waitInSeconds)) {
+        return int(WAIT_INTERVAL);
+    }
+
+    if (waitInSeconds < WAIT_INTERVAL)
+    {
+        return int(waitInSeconds);
+    }
+
+    const auto remainingTime = int(waitInSeconds - elapsedTime);
+    return remainingTime <= WAIT_INTERVAL ? remainingTime : WAIT_INTERVAL;
+}
+
 /// Enables or disables an Event Log channel.
 ///
 /// \param ChannelPath  Full path to the event log channel.
 ///
 /// \return None
 ///
-void
+DWORD
 EventMonitor::EnableEventLogChannel(
     _In_ LPCWSTR ChannelPath
     )
@@ -700,13 +834,15 @@ EventMonitor::EnableEventLogChannel(
 
     if (ERROR_SUCCESS != status)
     {
-        logWriter.TraceError(
-            Utility::FormatString(L"Failed to enable event channel %ws: 0x%X", ChannelPath, status).c_str()
+        logWriter.TraceInfo(
+            Utility::FormatString(L"Waiting for %ws event channel to be enabled", ChannelPath).c_str()
         );
     }
 
     if (channelConfig != NULL)
     {
         EvtClose(channelConfig);
     }
+
+    return status;
 }
diff --git a/LogMonitor/src/LogMonitor/EventMonitor.h b/LogMonitor/src/LogMonitor/EventMonitor.h
@@ -8,6 +8,9 @@
 class EventMonitor final
 {
 public:
+
+    static const int WAIT_INTERVAL = 15;
+
     EventMonitor() = delete;
 
     EventMonitor(
@@ -56,7 +59,14 @@ class EventMonitor final
         _In_ const HANDLE& EventHandle
         );
 
+    static LARGE_INTEGER _ConvertWaitIntervalToLargeInt(
+            int timeInterval);
+
+        static int _GetWaitInterval(
+            std::double_t waitInSeconds,
+            int elapsedTime);
+
     void EnableEventLogChannels();
 
-    static void EnableEventLogChannel(_In_ LPCWSTR ChannelPath);
+    static DWORD EnableEventLogChannel(_In_ LPCWSTR ChannelPath);
 };