Example #1
0
 /// <summary>
 /// Parse a provider input definition
 /// This function can retrieve provider from Name definition or Guid definition
 ///
 /// A name definition is associated with a manifest based provider and function will
 /// check if the provider is recorded on current workstation
 ///
 /// If name is not found we will try to parse Guid definition.
 /// A Guid definition must follow :
 ///     TYPE{GUID}
 /// When
 ///     TYPE: Manifest | TL | WPP
 ///     GUID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 ///
 /// </summary>
 /// <param name="name">provider input definition</param>
 /// <param name="provider">ProviderGuid</param>
 /// <returns>true if parsed succesfully</returns>
 public static bool TryParse(string name, out ProviderGuid provider)
 {
     try
     {
         provider = Parse(name);
         return(true);
     }
     catch (Exception)
     {
         provider = null;
         return(false);
     }
 }
Example #2
0
 /// <summary>
 /// Try to build a forwarder
 /// Handle all subexception
 /// </summary>
 /// <param name="providerGuid">provider input definition</param>
 /// <param name="forwarder">result as provider</param>
 /// <returns>true if built successfully</returns>
 public static bool TryBuild(ProviderGuid providerGuid, out Forwarder forwarder)
 {
     try
     {
         var result = Build(providerGuid);
         forwarder = result;
         return(true);
     }
     catch (System.ApplicationException)
     {
         forwarder = null;
         return(false);
     }
 }
Example #3
0
        /// <summary>
        /// Build a correct forwarder with the matched Parser
        /// Follow the factory model
        /// </summary>
        /// <param name="provider">ProviderGuid input provider</param>
        /// <returns></returns>
        public static Forwarder Build(ProviderGuid provider)
        {
            switch (provider.Type)
            {
            case ProviderGuid.ProviderType.Manifest:
                var           xml        = RegisteredTraceEventParser.GetManifestForRegisteredProvider(provider.Guid);
                XmlSerializer serializer = new XmlSerializer(typeof(Manifest.Manifest));
                using (TextReader reader = new StringReader(xml))
                {
                    var manifest = (Manifest.Manifest)serializer.Deserialize(reader);
                    return(new Forwarder(new ManifestParser(manifest)));
                }

            case ProviderGuid.ProviderType.TL:
                return(new Forwarder(new TraceLoggingParser()));

            case ProviderGuid.ProviderType.WPP:
                return(new Forwarder(new NullParser()));
            }

            throw new NotImplementedException();
        }
Example #4
0
        /// <summary>
        /// This function build an ETW usertrace from
        /// a configuration INI file and a selected IETWWriter
        /// </summary>
        /// <param name="config">configuration that come from an ini file</param>
        /// <param name="writer">how to writer etw</param>
        /// <returns></returns>
        public static UserTrace BuildFromConfig(IniData config, IETWWriter writer)
        {
            var providers = new Dictionary <Guid, Provider>();

            foreach (var providerConfig in config.Sections)
            {
                // try to parse filtering provider
                var providerDeclaration = providerConfig.SectionName.Split(new string[] { "://" }, StringSplitOptions.RemoveEmptyEntries);
                if (providerDeclaration.Length > 2)
                {
                    continue;
                }

                string providerName = providerDeclaration[0];

                // Try to parse provider name
                ProviderGuid providerGuid = null;
                if (!ProviderGuid.TryParse(providerName, out providerGuid))
                {
                    continue;
                }

                Forwarder forwarder = null;
                if (!Forwarder.TryBuild(providerGuid, out forwarder))
                {
                    continue;
                }

                UInt16?eventId = null;
                if (providerDeclaration.Length == 2)
                {
                    UInt16 tmp = 0;
                    if (!UInt16.TryParse(providerDeclaration[1], out tmp))
                    {
                        continue;
                    }
                    eventId = tmp;
                }

                if (!providers.ContainsKey(providerGuid.Guid))
                {
                    providers.Add(providerGuid.Guid, new Provider(providerGuid.Guid));
                }

                var provider = providers[providerGuid.Guid];

                var predicate = Filter.AnyEvent();

                if (eventId != null)
                {
                    predicate = Filter.EventIdIs(eventId.Value);
                }

                var filter = new EventFilter(predicate);
                foreach (var keyValue in providerConfig.Keys)
                {
                    forwarder.AddFilter(keyValue.KeyName, keyValue.Value);
                }

                filter.OnEvent += (IEventRecord record) =>
                {
                    try
                    {
                        forwarder.Forward(record, writer).Wait();
                    }
                    catch (System.AggregateException) { } // Some event ae not documented even for Microsoft
                };

                provider.AddFilter(filter);
            }

            if (providers.Count == 0)
            {
                throw new Exception("Unable to create a trace without provider");
            }

            UserTrace trace = new UserTrace(String.Format("Splunk-ETW-{0}", Guid.NewGuid().ToString()));

            foreach (var provider in providers.Values)
            {
                trace.Enable(provider);
            }

            return(trace);
        }