private bool ApplyFilterCategoryEventToEventItem(EventItem ei)
{
bool washidden = ei.IsHidden;
switch (ei.Event)
{
case "CreateProcess":
case "CreateProcessAsUser":
if ((bool)cbCatProcess.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "CreateFile":
case "CreateFile2":
case "CopyFile":
case "CopyFile2":
case "CopyFileEx":
case "CreateHardLink":
case "CreateSymbolicLink":
case "DeleteFile":
case "MoveFile":
case "MoveFileEx":
case "ReplaceFile":
case "FindFirstFile":
case "FindFirstFileEx":
case "FindNextFile":
case "FindClose":
case "CreateDirectory":
case "CreateDirectoryEx":
case "RemoveDirectory":
case "SetCurrentDirectory":
case "GetCurrentDirectory":
case "GetFileAttributes":
case "SetFileAttributes":
case "GetFileAttributesEx":
if ((bool)cbCatFile.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "RegCreateKey":
case "RegCreateKeyEx":
case "RegOpenKey":
case "RegOpenKeyEx":
case "RegGetValue":
case "RegQueryValue":
case "RegQueryValueEx":
case "RegSetKeyValue":
case "RegSetValue":
case "RegSetValueEx":
case "RegDeleteKey":
case "RegDeleteKeyEx":
case "RegDeleteKeyValue":
case "RegDeleteValue":
case "RegDeleteTree":
case "RegCopyTree":
case "RegEnumKey":
case "RegEnumKeyEx":
case "RegEnumValue":
if ((bool)cbCatReg.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
// NT Level
case "NtCreateFile":
case "NtOpenFile":
case "NtCreateDirectoryObject":
case "NtOpenDirectoryObject":
case "NtQueryDirectoryObject":
case "NtOpenSymbolicLinkObject":
case "NtQuerySymbolicLinkObject":
if ((bool)cbCatNTFile.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "NtCreateKey":
case "NtOpenKey":
case "NtOpenKeyEx":
case "NtSetValueKey":
case "NtQueryValueKey":
if ((bool)cbCatNTReg.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "AddDllDirectory":
case "LoadLibrary":
case "LoadLibraryEx":
case "LoadModule":
case "LoadPackagedLibrary":
case "RemoveDllDirectory":
case "SetDefaultDllDirectories":
case "SetDllDirectory":
if ((bool)cbCatDll.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
// Kernel traces
case "Process/Start":
case "Process/Stop":
if ((bool)cbCatKernelProcess.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "Image/Load":
if ((bool)cbCatKernelImageLoad.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "FileIO/Query":
case "FileIO/QueryInfo":
case "FileIO/Create":
case "FileIO/FileCreate":
case "FileIO/Read":
case "FileIO/Write":
case "FileIO/Close":
case "FileIO/Cleanup":
case "FileIO/OperationEnd":
case "FileIO/DirEnum":
case "FileIO/SetInfo":
case "FileIO/Rename":
case "FileIO/Delete":
case "FileIO/FileDelete":
case "FileIO/Flush":
if ((bool)cbCatKernelFile.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "DiskIO/Read":
case "DiskIO/Write":
if ((bool)cbCatKernelDisk.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "Registry/Open":
case "Registry/Query":
case "Registry/QueryValue":
case "Registry/SetInformation":
case "Registry/Close":
case "Registry/Create":
case "Registry/SetValue":
case "Registry/EnumerateKey":
case "Registry/Delete":
case "Registry/DeleteValue":
case "Registry/EnumerateValueKey":
if ((bool)cbCatKernelRegistry.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "Application":
if ((bool)cbCatApplicationLog.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
case "System":
if ((bool)cbCatSystemLog.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
default:
if ((bool)cbCatOther.IsChecked)
{
ei.IsEventCatHidden = false;
}
else
{
ei.IsEventCatHidden = true;
}
break;
}
if (ei.IsHidden != washidden)
{
return(true);
}
else
{
return(false);
}
}
private bool ApplyFilterResultToEventItem(EventItem ei)
{
bool washidden = ei.IsHidden;
if (ei.Result.StartsWith("Success"))
{
if ((bool)cbSuccesss.IsChecked)
{
ei.IsResultHidden = false;
}
else
{
ei.IsResultHidden = true;
}
ei.EventIsResultClass = "Normal";
}
else if (ei.Result.StartsWith("Unknown") ||
ei.Result.StartsWith("Indeterminate"))
{
if ((bool)cbIntermediate.IsChecked)
{
ei.IsResultHidden = false;
}
else
{
ei.IsResultHidden = true;
}
ei.EventIsResultClass = "Warning";
}
else if (ei.Result.StartsWith("Expected Failure"))
{
if ((bool)cbExpectedFailure.IsChecked)
{
ei.IsResultHidden = false;
}
else
{
ei.IsResultHidden = true;
}
ei.EventIsResultClass = "Warning";
}
else if (ei.Result.StartsWith("Failure"))
{
if ((bool)cbFailure.IsChecked)
{
ei.IsResultHidden = false;
}
else
{
ei.IsResultHidden = true;
}
ei.EventIsResultClass = "Failure";
}
else
{
ei.EventIsResultClass = "Normal"; // TODO: Reults starting with other stuff
}
if (ei.IsHidden != washidden)
{
return(true);
}
else
{
return(false);
}
}
} // ETWTraceInBackground_Start()
private void Eventbgw_DoWork(object sender, DoWorkEventArgs e)
{
// This is the background thread
Provider etwp = e.Argument as Provider;
BackgroundWorker worker = sender as BackgroundWorker;
Thread.CurrentThread.Name = "ETWReader";
using (myTraceEventSession = new TraceEventSession(etwp.name, TraceEventSessionOptions.Create))
{
myTraceEventSession.StopOnDispose = true;
myTraceEventSession.Source.Dynamic.All += delegate(TraceEvent data) // Set Source (stream of events) from session.
{ // Get dynamic parser (knows about EventSources)
// Subscribe to all EventSource events
string operation = "";
string inputs = "";
string result = "";
string outputs = "";
string caller = "";
Int64 start = 0;
Int64 end = 0;
try
{
operation = (string)data.PayloadByName("Operation");
}
catch
{
// expected possible condition
}
try
{
inputs = (string)data.PayloadByName("Inputs");
}
catch
{
// expected possible condition
}
try
{
result = (string)data.PayloadByName("Result");
}
catch
{
// expected possible condition
}
try
{
outputs = (string)data.PayloadByName("Outputs");
}
catch
{
// expected possible condition
}
try
{
caller = (string)data.PayloadByName("Caller");
}
catch
{
// expected possible condition
}
if (inputs == null && result == null && outputs == null)
{
try
{
outputs = (string)data.PayloadByName("Message");
}
catch
{
// expected possible condition
}
}
try
{
start = (Int64)data.PayloadByName("Start");
}
catch
{
// expected possible condition
}
try
{
end = (Int64)data.PayloadByName("End");
}
catch
{
// expected possible condition
}
EventItem ei = new EventItem((int)data.EventIndex,
start,
end,
data.TimeStamp,
data.ProcessName,
data.ProcessID,
data.ThreadID,
data.ProviderName,
operation,
inputs,
result,
outputs,
caller
);
lock (_TEventListsLock)
{
_TEventListItems.Add(ei);
AddToProcIDsList(data.ProcessID);
}
worker.ReportProgress((int)data.EventIndex);
};
EventTraceProviderEnablementResultCode = myTraceEventSession.EnableProvider(etwp.guid);
if (!EventTraceProviderEnablementResultCode)
{
// Attempt resetting for second run...
myTraceEventSession.DisableProvider(etwp.guid);
EventTraceProviderEnablementResultCode = myTraceEventSession.EnableProvider(etwp.guid);
}
EventTraceProviderSourceResultCode = myTraceEventSession.Source.Process();
}
} // Eventbgw_DoWork()
} // Eventbgw_RunWorkerCompleted()
#region UIFilter
private void AppplyFilterToEventItem(EventItem ei)
{
ApplyFilterResultToEventItem(ei);
ApplyFilterCategoryEventToEventItem(ei);
ApplyFilterProcessIdToEventItem(ei);
}
} //ETWTraceInBackground_Start_APPS()
private void ETWTraceInBackground_DoWork_APPS(object sender, DoWorkEventArgs e)
{
// This is the background thread
int count = 0;
string etwclass = e.Argument as string;
BackgroundWorker worker = sender as BackgroundWorker;
Thread.CurrentThread.Name = "ETWReaderAPPS";
//Thread.CurrentThread.Priority = ThreadPriority.BelowNormal;
try
{
string sQuery = "*[System/Level>0]";
EventLogQuery Q_Operational = new EventLogQuery(etwclass, PathType.LogName, sQuery);
EventBookmark Ev_OperationalBookmark = null;
EventLogReader R_Operational;
R_Operational = new EventLogReader(Q_Operational); // Walk through existing list to create a bookmark
R_Operational.Seek(System.IO.SeekOrigin.End, 0);
for (EventRecord eventInstance = R_Operational.ReadEvent();
null != eventInstance;
eventInstance = R_Operational.ReadEvent())
{
Ev_OperationalBookmark = eventInstance.Bookmark;
}
R_Operational.Dispose();
WaitingForEventStart_APPS = false;
worker.ReportProgress(count++);
while (!worker.CancellationPending && !PleaseStopCollecting)
{
Thread.Sleep(1000);
R_Operational = new EventLogReader(Q_Operational, Ev_OperationalBookmark);
for (EventRecord eventInstance = R_Operational.ReadEvent();
null != eventInstance;
eventInstance = R_Operational.ReadEvent())
{
Ev_OperationalBookmark = eventInstance.Bookmark;
try
{
DateTime et = eventInstance.TimeCreated.GetValueOrDefault();
EventItem eItem = new EventItem((int)et.Ticks, et.Ticks, et.Ticks, et, eventInstance.ProcessId.ToString(), (int)eventInstance.ProcessId, (int)eventInstance.ThreadId,
eventInstance.LogName, "Application", eventInstance.Id.ToString(), eventInstance.LevelDisplayName, eventInstance.FormatDescription(), "");
worker.ReportProgress(count++, eItem);
}
catch
{
// app provider might be virtual or missing
string leveldisplayname = "";
string stuff = "Formatter not available. Details:";
int ProcessId = -1;
int ThreadId = -1;
switch (eventInstance.Level)
{
case 1:
leveldisplayname = "Critical";
break;
case 2:
leveldisplayname = "Error";
break;
case 3:
leveldisplayname = "Warning";
break;
case 4:
leveldisplayname = "Information";
break;
default:
break;
}
foreach (EventProperty p in eventInstance.Properties)
{
stuff += p.Value.ToString() + " ";
}
if (eventInstance.ProcessId != null)
{
ProcessId = (int)eventInstance.ProcessId;
}
if (eventInstance.ThreadId != null)
{
ThreadId = (int)eventInstance.ThreadId;
}
DateTime et = eventInstance.TimeCreated.GetValueOrDefault();
EventItem eItem = new EventItem((int)et.Ticks, et.Ticks, et.Ticks, et, eventInstance.ProcessId.ToString(), (int)eventInstance.ProcessId, (int)eventInstance.ThreadId,
eventInstance.LogName, "Application", eventInstance.Id.ToString(), leveldisplayname, stuff, "");
worker.ReportProgress(count++, eItem);
}
}
R_Operational.Dispose();
}
}
catch
{
WaitingForEventStart_APPS = false;
}
} // ETWTraceInBackground_DoWork_APPS()
