/// <inheritdoc />
 public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     if (data.ReportedProcesses != null && data.ReportedProcesses.Count > 0)
     {
         m_reportedProcesses[data.PipId] = data.ReportedProcesses;
     }
 }
Example #2
0
 /// <summary>
 /// Record observed file accesses if the flag is set.
 /// </summary>
 public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     if (m_dumpObservedFileAccesses && data.PipId == m_pip.PipId)
     {
         m_dynamicData = data;
     }
 }
 /// <summary>
 /// This event will get data about reported file accesses and reported processes.
 /// The data will be added to <see cref="m_dynamicDataDictionary"/>, and will be dumped if the pip fails
 /// in the PipExecutionPerformance event.
 /// </summary>
 /// <param name="data"></param>
 public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     if (m_shouldDumpDynamicData && !m_loggingErrorOccured && m_numLogFilesGenerated < m_maxLogFiles)
     {
         m_dynamicDataDictionary.TryAdd(data.PipId, data);
     }
 }
Example #4
0
        public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
        {
            if (ListFilePath != null)
            {
                m_reportedProcesses[data.PipId] = data.ReportedProcesses;
            }

            if (SummaryFilePath != null)
            {
                foreach (var reportedProcess in data.ReportedProcesses)
                {
                    var         pathKey = CaseInsensitive ? reportedProcess.Path.ToLowerInvariant() : reportedProcess.Path;
                    PathSummary pathSummary;
                    if (!m_summaryByPath.TryGetValue(pathKey, out pathSummary))
                    {
                        pathSummary = m_summaryByPath[pathKey] = new PathSummary();
                    }

                    pathSummary.Pips.Add(data.PipId);
                    pathSummary.Count++;
                    pathSummary.ZeroExitCodeCount += (reportedProcess.ExitCode == 0 ? 1 : 0);
                    pathSummary.WallClockTime     += (reportedProcess.ExitTime - reportedProcess.CreationTime);
                    pathSummary.KernelTime        += reportedProcess.KernelTime;
                    pathSummary.UserTime          += reportedProcess.UserTime;
                }
            }
        }
Example #5
0
        public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
        {
            if (!IsFailedPipOrDependency(data.PipId))
            {
                // Only record inputs for failed pips or their transitive dependencies
                return;
            }

            // Contains : ReportedProcesses (process chain),
            //            ReportedFileAccesses, WhitelistedReportedFileAccesses, ProcessDetouringStatuses
            m_pipProcessExecutionMonitoringReported.Add(data.PipId, data);
        }
Example #6
0
 public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     if (data.PipId == m_pip.PipId)
     {
         m_sections.Add(
             m_html.CreateBlock(
                 "Process Execution Monitoring",
                 m_html.CreateRow("ReportedProcesses", new XElement("div", data.ReportedProcesses.Select(RenderReportedProcess))),
                 m_html.CreateRow("ReportedFileAcceses", new XElement("div", data.ReportedFileAccesses.Select(RenderReportedFileAccess))),
                 m_html.CreateRow("WhitelistedReportedFileAccesses", new XElement("div", data.WhitelistedReportedFileAccesses.Select(RenderReportedFileAccess))),
                 m_html.CreateRow("ProcessDetouringStatuses", new XElement("div", data.ProcessDetouringStatuses.Select(RenderProcessDetouringStatusData)))));
     }
 }
            public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
            {
                var semistableHash = CachedGraph.PipTable.GetPipSemiStableHash(data.PipId);

                if (!IsFailedPipOrDependency(semistableHash))
                {
                    // Only record inputs for failed pips or their transitive dependencies
                    return;
                }

                // Contains : ReportedProcesses (process chain),
                //            ReportedFileAccesses, AllowlistedReportedFileAccesses, ProcessDetouringStatuses
                m_pipProcessExecutionMonitoringReported.Add(data.PipId, data);
            }
Example #8
0
        /// <summary>
        /// Override event to capture its data and store it in the protobuf
        /// </summary>
        public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
        {
            var value = data.ToProcessExecutionMonitoringReportedEvent(WorkerID.Value, PathTable, m_nameExpander);
            var key   = new EventKey
            {
                EventTypeID = Xldb.Proto.ExecutionEventId.ProcessExecutionMonitoringReported,
                PipId       = data.PipId.Value
            };

            var keyArr   = key.ToByteArray();
            var valueArr = value.ToByteArray();

            WriteToDb(keyArr, valueArr, XldbDataStore.EventColumnFamilyName);
            AddToDbStorageDictionary(DBStoredTypes.ProcessExecutionMonitoringReported, keyArr.Length + valueArr.Length);
        }
Example #9
0
        /// <nodoc />
        public static ProcessExecutionMonitoringReportedEvent ToProcessExecutionMonitoringReportedEvent(this ProcessExecutionMonitoringReportedEventData data, uint workerID, PathTable pathTable, NameExpander nameExpander)
        {
            var processExecutionMonitoringReportedEvent = new ProcessExecutionMonitoringReportedEvent
            {
                WorkerID = workerID,
                PipID    = data.PipId.Value
            };

            processExecutionMonitoringReportedEvent.ReportedProcesses.AddRange(
                data.ReportedProcesses.Select(rp => rp.ToReportedProcess()));
            processExecutionMonitoringReportedEvent.ReportedFileAccesses.AddRange(
                data.ReportedFileAccesses.Select(reportedFileAccess => reportedFileAccess.ToReportedFileAccess(pathTable, nameExpander)));
            processExecutionMonitoringReportedEvent.WhitelistedReportedFileAccesses.AddRange(
                data.WhitelistedReportedFileAccesses.Select(
                    whiteListReportedFileAccess => whiteListReportedFileAccess.ToReportedFileAccess(pathTable, nameExpander)));

            foreach (var processDetouringStatus in data.ProcessDetouringStatuses)
            {
                processExecutionMonitoringReportedEvent.ProcessDetouringStatuses.Add(new Xldb.Proto.ProcessDetouringStatusData()
                {
                    ProcessID            = processDetouringStatus.ProcessId,
                    ReportStatus         = processDetouringStatus.ReportStatus,
                    ProcessName          = processDetouringStatus.ProcessName,
                    StartApplicationName = processDetouringStatus.StartApplicationName,
                    StartCommandLine     = processDetouringStatus.StartCommandLine,
                    NeedsInjection       = processDetouringStatus.NeedsInjection,
                    Job                       = processDetouringStatus.Job,
                    DisableDetours            = processDetouringStatus.DisableDetours,
                    CreationFlags             = processDetouringStatus.CreationFlags,
                    Detoured                  = processDetouringStatus.Detoured,
                    Error                     = processDetouringStatus.Error,
                    CreateProcessStatusReturn = processDetouringStatus.CreateProcessStatusReturn
                });
            }

            return(processExecutionMonitoringReportedEvent);
        }
Example #10
0
 /// <inheritdoc />
 public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     m_processDetouringsMap[data.PipId] = data.ProcessDetouringStatuses;
 }
Example #11
0
 /// <inheritdoc />
 public virtual void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     ReportUnhandledEvent(data);
 }
Example #12
0
 /// <inheritdoc />
 public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     // Just collect all the directory output data for each reported pip
     m_directoryInputContent[data.PipId] = data;
 }
Example #13
0
 /// <inheritdoc />
 public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     m_processMonitoringData[data.PipId] = data;
 }
 public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     m_observedAccessMap[data.PipId] = data.ReportedFileAccesses;
 }
Example #15
0
 public override void ProcessExecutionMonitoringReported(ProcessExecutionMonitoringReportedEventData data)
 {
     m_toolEnumerationMap[data.PipId] = data.ReportedFileAccesses;
 }