Skip to content

Commit 117d20f

Browse files
LordHepipudLordHepipud
authored
Merge pull request #682 from Icinga:feature/new_eventlog_provider
Feature: Adds new Eventlog data provider Adds new data provider for fetching Eventlog information to increase performance and reduce memory impact
2 parents c10b8f6 + fcd2d52 commit 117d20f

6 files changed

+370
-0
lines changed

‎doc/100-General/10-Changelog.md

+1
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ Released closed milestones can be found on [GitHub](https://github.com/Icinga/ic
2424
* [#631](https://github.com/Icinga/icinga-powershell-framework/pull/631) Deduplicates `-C try { Use-Icinga ...` boilerplate by adding it to the `PowerShell Base` template and removing it from every single command
2525
* [#669](https://github.com/Icinga/icinga-powershell-framework/pull/669) Adds new metric to the CPU provider, allowing for distinguishing between the average total load as well as the sum of it
2626
* [#679](https://github.com/Icinga/icinga-powershell-framework/pull/679) Adds a new data provider for fetching process information of Windows systems, while sorting all objects based on a process name and their process id
27+
* [#682](https://github.com/Icinga/icinga-powershell-framework/pull/682) Adds new data provider for fetching Eventlog information to increase performance and reduce memory impact
2728
* [#688](https://github.com/Icinga/icinga-powershell-framework/pull/688) Adds new handling to add scheduled tasks in Windows for interacting with Icinga for Windows core functionality as well as an auto renewal task for the Icinga for Windows certificate generation
2829
* [#690](https://github.com/Icinga/icinga-powershell-framework/pull/690) Adds automatic renewal of the `icingaforwindows.pfx` certificate for the REST-Api daemon in case the certificate is not yet present, valid or changed during the runtime of the daemon while also making the `icingaforwindows.pfx` mandatory for all installations, regardless of JEA being used or not
2930
* [#692](https://github.com/Icinga/icinga-powershell-framework/pull/692) Renames `Restart-IcingaWindowsService` to `Restart-IcingaForWindows` and adds alias for backwards compatibility to start unifying the Icinga for Windows cmdlets

‎lib/provider/core/Get-IcingaProviderFilterData.psm1

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
function Get-IcingaProviderFilterData()
2+
{
3+
param (
4+
[string]$ProviderName = '',
5+
[hashtable]$ProviderFilter = @()
6+
);
7+
8+
[hashtable]$FilterResult = @{ };
9+
10+
foreach ($filterObject in $ProviderFilter.Keys) {
11+
if ($filterObject.ToLower() -ne $ProviderName.ToLower()) {
12+
continue;
13+
}
14+
15+
if ($FilterResult.ContainsKey($filterObject) -eq $FALSE) {
16+
$FilterResult.Add(
17+
$filterObject,
18+
(New-IcingaProviderFilterObject -ProviderName $ProviderName -HashtableFilter $ProviderFilter[$filterObject])
19+
);
20+
}
21+
}
22+
23+
return $FilterResult;
24+
}

‎lib/provider/core/New-IcingaProviderFilterObject.psm1

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
function New-IcingaProviderFilterObject()
2+
{
3+
param (
4+
[string]$ProviderName = '',
5+
[hashtable]$HashtableFilter = @{ }
6+
);
7+
8+
if ([string]::IsNullOrEmpty($ProviderName)) {
9+
return @{ };
10+
}
11+
12+
[array]$ProviderFilterCmdlet = Get-Command ([string]::Format('New-IcingaProviderFilterData{0}', $ProviderName)) -ErrorAction SilentlyContinue;
13+
14+
if ($null -eq $ProviderFilterCmdlet -Or $ProviderFilterCmdlet.Count -eq 0) {
15+
return @{ };
16+
}
17+
18+
if ((Test-IcingaForWindowsCmdletLoader -Path $ProviderFilterCmdlet[0].Module.ModuleBase) -eq $FALSE) {
19+
return @{ };
20+
}
21+
22+
$FilterResult = & $ProviderFilterCmdlet[0].Name @HashtableFilter;
23+
24+
[string]$ObjectName = $ProviderName;
25+
$CmdHelp = Get-Help ($ProviderFilterCmdlet[0].Name) -ErrorAction SilentlyContinue;
26+
27+
if ($null -ne $CmdHelp) {
28+
if ([string]::IsNullOrEmpty($CmdHelp.Role) -eq $FALSE) {
29+
[string]$ObjectName = [string]($CmdHelp.Role);
30+
}
31+
}
32+
33+
$CmdHelp = $null;
34+
$ProviderFilterCmdlet = $null;
35+
36+
return @{
37+
$ObjectName = $FilterResult;
38+
};
39+
}

‎lib/provider/logging/Add-IcingaProviderEventlogFilterData.psm1

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
function Add-IcingaProviderEventlogFilterData()
2+
{
3+
param(
4+
[string]$EventFilter = '',
5+
$StringBuilderObject = $null
6+
);
7+
8+
if ($null -eq $StringBuilderObject -Or $StringBuilderObject.Length -eq 0) {
9+
return $EventFilter;
10+
}
11+
12+
[string]$NewStringEntry = $StringBuilderObject.ToString();
13+
14+
$StringBuilderObject.Clear();
15+
$StringBuilderObject = $null;
16+
17+
if ([string]::IsNullOrEmpty($NewStringEntry)) {
18+
return $EventFilter;
19+
}
20+
21+
if ([string]::IsNullOrEmpty($EventFilter)) {
22+
return $NewStringEntry;
23+
}
24+
25+
[string]$EventFilter = [string]::Format('{0} and {1}', $EventFilter, $NewStringEntry);
26+
27+
return $EventFilter;
28+
}

‎lib/provider/logging/Get-IcingaProviderDataValuesEventlog.psm1

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
function Get-IcingaProviderDataValuesEventlog()
2+
{
3+
param (
4+
[array]$IncludeFilter = @(),
5+
[array]$ExcludeFilter = @(),
6+
[hashtable]$ProviderFilter = @(),
7+
[switch]$IncludeDetails = $FALSE
8+
);
9+
10+
$EventlogData = New-IcingaProviderObject -Name 'Eventlog';
11+
[hashtable]$FilterObject = Get-IcingaProviderFilterData -ProviderName 'Eventlog' -ProviderFilter $ProviderFilter;
12+
13+
$EventLogData.Metrics | Add-Member -MemberType NoteProperty -Name 'List' -Value $FilterObject.EventLog.Query.List;
14+
$EventLogData.Metrics | Add-Member -MemberType NoteProperty -Name 'Events' -Value $FilterObject.EventLog.Query.Events;
15+
$EventLogData.Metrics | Add-Member -MemberType NoteProperty -Name 'HasEvents' -Value $FilterObject.EventLog.Query.HasEvents;
16+
17+
$FilterObject = $null;
18+
19+
return $EventlogData;
20+
}

‎lib/provider/logging/New-IcingaProviderFilterDataEventlog.psm1

+258
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,258 @@
1+
<#
2+
.ROLE
3+
Query
4+
#>
5+
6+
function New-IcingaProviderFilterDataEventlog()
7+
{
8+
param(
9+
[string]$LogName = '',
10+
[array]$IncludeEventId = @(),
11+
[array]$ExcludeEventId = @(),
12+
[array]$IncludeUsername = @(),
13+
[array]$ExcludeUsername = @(),
14+
[array]$IncludeEntryType = @(),
15+
[array]$ExcludeEntryType = @(),
16+
[array]$IncludeMessage = @(),
17+
[array]$ExcludeMessage = @(),
18+
[array]$IncludeSource = @(),
19+
[array]$ExcludeSource = @(),
20+
[string]$EventsAfter = $null,
21+
[string]$EventsBefore = $null,
22+
[int]$MaxEntries = 40000,
23+
[switch]$DisableTimeCache = $FALSE
24+
);
25+
26+
[string]$EventLogFilter = '';
27+
$EventIdFilter = New-Object -TypeName 'System.Text.StringBuilder';
28+
$EntryTypeFilter = New-Object -TypeName 'System.Text.StringBuilder';
29+
$SourceFilter = New-Object -TypeName 'System.Text.StringBuilder';
30+
$UserFilter = New-Object -TypeName 'System.Text.StringBuilder';
31+
$TimeFilter = New-Object -TypeName 'System.Text.StringBuilder';
32+
$EventAfterFilter = $null;
33+
$EventBeforeFilter = $null;
34+
$EventsAfter = (Convert-IcingaPluginThresholds -Threshold $EventsAfter).Value;
35+
$EventsBefore = (Convert-IcingaPluginThresholds -Threshold $EventsBefore).Value;
36+
[string]$CheckHash = (Get-StringSha1 ($LogName + $IncludeEventId + $ExcludeEventId + $IncludeUsername + $ExcludeUsername + $IncludeEntryType + $ExcludeEntryType + $IncludeMessage + $ExcludeMessage)) + '.lastcheck';
37+
38+
if ([string]::IsNullOrEmpty($EventsAfter) -and $DisableTimeCache -eq $FALSE) {
39+
$time = Get-IcingaCacheData -Space 'provider' -CacheStore 'eventlog' -KeyName $CheckHash;
40+
Set-IcingaCacheData -Space 'provider' -CacheStore 'eventlog' -KeyName $CheckHash -Value ((Get-Date).ToFileTime());
41+
42+
if ($null -ne $time) {
43+
$EventAfterFilter = ([datetime]::FromFileTime($time)).ToString("yyyy-MM-dd HH:mm:ss");
44+
}
45+
}
46+
47+
# In case we are not having cached time execution and not have not overwritten the timestamp, only fetch values from 2 hours in the past
48+
if ([string]::IsNullOrEmpty($EventAfterFilter)) {
49+
if ([string]::IsNullOrEmpty($EventsAfter)) {
50+
[string]$EventAfterFilter = ([datetime]::Now.Subtract([TimeSpan]::FromHours(2))).ToString("yyyy-MM-dd HH:mm:ss");
51+
} else {
52+
if ((Test-Numeric $EventsAfter)) {
53+
[string]$EventAfterFilter = ([datetime]::Now.Subtract([TimeSpan]::FromSeconds($EventsAfter))).ToString('yyyy\/MM\/dd HH:mm:ss');
54+
} else {
55+
[string]$EventAfterFilter = $EventsAfter;
56+
}
57+
}
58+
}
59+
60+
if ([string]::IsNullOrEmpty($EventsBefore) -eq $FALSE) {
61+
if ((Test-Numeric $EventsBefore)) {
62+
[string]$EventBeforeFilter = ([datetime]::Now.Subtract([TimeSpan]::FromSeconds($EventsBefore))).ToString("yyyy-MM-dd HH:mm:ss");
63+
} else {
64+
[string]$EventBeforeFilter = $EventsBefore;
65+
}
66+
} else {
67+
[string]$EventBeforeFilter = ([datetime]::FromFileTime(((Get-Date).ToFileTime()))).ToString("yyyy-MM-dd HH:mm:ss");
68+
}
69+
70+
foreach ($entry in $IncludeEventId) {
71+
if ($EventIdFilter.Length -ne 0) {
72+
$EventIdFilter.Append(
73+
([string]::Format(' and EventID={0}', $entry))
74+
) | Out-Null;
75+
} else {
76+
$EventIdFilter.Append(
77+
([string]::Format('EventID={0}', $entry))
78+
) | Out-Null;
79+
}
80+
}
81+
82+
foreach ($entry in $ExcludeEventId) {
83+
if ($EventIdFilter.Length -ne 0) {
84+
$EventIdFilter.Append(
85+
([string]::Format(' and EventID!={0}', $entry))
86+
) | Out-Null;
87+
} else {
88+
$EventIdFilter.Append(
89+
([string]::Format('EventID!={0}', $entry))
90+
) | Out-Null;
91+
}
92+
}
93+
94+
foreach ($entry in $IncludeEntryType) {
95+
[string]$EntryId = $ProviderEnums.EventLogSeverity[$entry];
96+
if ($EntryTypeFilter.Length -ne 0) {
97+
$EntryTypeFilter.Append(
98+
([string]::Format(' and Level={0}', $EntryId))
99+
) | Out-Null;
100+
} else {
101+
$EntryTypeFilter.Append(
102+
([string]::Format('Level={0}', $EntryId))
103+
) | Out-Null;
104+
}
105+
}
106+
107+
foreach ($entry in $ExcludeEntryType) {
108+
[string]$EntryId = $ProviderEnums.EventLogSeverity[$entry];
109+
if ($EntryTypeFilter.Length -ne 0) {
110+
$EntryTypeFilter.Append(
111+
([string]::Format(' and Level!={0}', $EntryId))
112+
) | Out-Null;
113+
} else {
114+
$EntryTypeFilter.Append(
115+
([string]::Format('Level!={0}', $EntryId))
116+
) | Out-Null;
117+
}
118+
}
119+
120+
foreach ($entry in $IncludeSource) {
121+
if ($SourceFilter.Length -ne 0) {
122+
$SourceFilter.Append(
123+
([string]::Format(' and Provider[@Name="{0}"]', $entry))
124+
) | Out-Null;
125+
} else {
126+
$SourceFilter.Append(
127+
([string]::Format('Provider[@Name="{0}"]', $entry))
128+
) | Out-Null;
129+
}
130+
}
131+
132+
foreach ($entry in $ExcludeSource) {
133+
if ($SourceFilter.Length -ne 0) {
134+
$SourceFilter.Append(
135+
([string]::Format(' and Provider[@Name!="{0}"]', $entry))
136+
) | Out-Null;
137+
} else {
138+
$SourceFilter.Append(
139+
([string]::Format('Provider[@Name!="{0}"]', $entry))
140+
) | Out-Null;
141+
}
142+
}
143+
144+
foreach ($entry in $IncludeUsername) {
145+
[string]$UserSID = (Get-IcingaUserSID -User $entry);
146+
if ($UserFilter.Length -ne 0) {
147+
$UserFilter.Append(
148+
([string]::Format(' and Security[@UserID="{0}', $UserSID))
149+
) | Out-Null;
150+
} else {
151+
$UserFilter.Append(
152+
([string]::Format('Security[@UserID="{0}"]', $UserSID))
153+
) | Out-Null;
154+
}
155+
}
156+
157+
foreach ($entry in $ExcludeUsername) {
158+
[string]$UserSID = (Get-IcingaUserSID -User $entry);
159+
if ($UserFilter.Length -ne 0) {
160+
$UserFilter.Append(
161+
([string]::Format(' and Security[@UserID!="{0}"]', $UserSID))
162+
) | Out-Null;
163+
} else {
164+
$UserFilter.Append(
165+
([string]::Format('Security[@UserID!="{0}"]', $UserSID))
166+
) | Out-Null;
167+
}
168+
}
169+
170+
$TimeFilter.Append(
171+
([string]::Format('TimeCreated[@SystemTime>="{0}"]', (Get-Date $EventAfterFilter).ToUniversalTime().ToString("yyyy-MM-dd'T'HH:mm:ssZ")))
172+
) | Out-Null;
173+
174+
$TimeFilter.Append(
175+
([string]::Format(' and TimeCreated[@SystemTime<="{0}"]', (Get-Date $EventBeforeFilter).ToUniversalTime().ToString("yyyy-MM-dd'T'HH:mm:ssZ")))
176+
) | Out-Null;
177+
178+
[string]$EventLogFilter = Add-IcingaProviderEventlogFilterData -EventFilter $EventLogFilter -StringBuilderObject $EventIdFilter;
179+
[string]$EventLogFilter = Add-IcingaProviderEventlogFilterData -EventFilter $EventLogFilter -StringBuilderObject $EntryTypeFilter;
180+
[string]$EventLogFilter = Add-IcingaProviderEventlogFilterData -EventFilter $EventLogFilter -StringBuilderObject $SourceFilter;
181+
[string]$EventLogFilter = Add-IcingaProviderEventlogFilterData -EventFilter $EventLogFilter -StringBuilderObject $UserFilter;
182+
[string]$EventLogFilter = Add-IcingaProviderEventlogFilterData -EventFilter $EventLogFilter -StringBuilderObject $TimeFilter;
183+
184+
while ($EventLogFilter[0] -eq ' ') {
185+
$EventLogFilter = $EventLogFilter.Substring(1, $EventLogFilter.Length - 1);
186+
}
187+
188+
[string]$EventLogFilter = [string]::Format('Event[System[{0}]]', $EventLogFilter);
189+
190+
try {
191+
$EventLogEntries = Get-WinEvent -LogName $LogName -MaxEvents $MaxEntries -FilterXPath $EventLogFilter -ErrorAction Stop;
192+
} catch {
193+
Exit-IcingaThrowException -InputString $_.FullyQualifiedErrorId -StringPattern 'ParameterArgumentValidationError' -ExceptionList $IcingaPluginExceptions -ExceptionType 'Input' -ExceptionThrown $IcingaPluginExceptions.Inputs.EventLogNegativeEntries;
194+
Exit-IcingaThrowException -InputString $_.FullyQualifiedErrorId -StringPattern 'CannotConvertArgumentNoMessage' -ExceptionList $IcingaPluginExceptions -ExceptionType 'Input' -ExceptionThrown $IcingaPluginExceptions.Inputs.EventLogNoMessageEntries;
195+
Exit-IcingaThrowException -InputString $_.FullyQualifiedErrorId -StringPattern 'NoMatchingLogsFound' -CustomMessage (-Join $LogName) -ExceptionList $IcingaPluginExceptions -ExceptionType 'Input' -ExceptionThrown $IcingaPluginExceptions.Inputs.EventLogLogName;
196+
}
197+
198+
$EventLogQueryData = New-Object PSCustomObject;
199+
$EventLogQueryData | Add-Member -MemberType NoteProperty -Name 'List' -Value (New-Object PSCustomObject);
200+
$EventLogQueryData | Add-Member -MemberType NoteProperty -Name 'Events' -Value (New-Object PSCustomObject);
201+
$EventLogQueryData | Add-Member -MemberType NoteProperty -Name 'HasEvents' -Value $FALSE;
202+
203+
foreach ($event in $EventLogEntries) {
204+
# Filter out remaining message not matching our filter
205+
if ((Test-IcingaArrayFilter -InputObject $event.Message -Include $IncludeMessage -Exclude $ExcludeMessage) -eq $FALSE) {
206+
continue;
207+
}
208+
209+
$EventLogQueryData.HasEvents = $TRUE;
210+
211+
[string]$EventIdentifier = [string]::Format('{0}-{1}',
212+
$event.Id,
213+
$event.ProviderName
214+
);
215+
216+
[string]$EventHash = Get-StringSha1 $EventIdentifier;
217+
218+
if ((Test-PSCustomObjectMember -PSObject $EventLogQueryData.List -Name $EventHash) -eq $FALSE) {
219+
[string]$EventMessage = [string]($event.Message);
220+
if ([string]::IsNullOrEmpty($EventMessage)) {
221+
$EventMessage = '';
222+
}
223+
224+
$EventLogQueryData.List | Add-Member -MemberType NoteProperty -Name $EventHash -Value (New-Object PSCustomObject);
225+
$EventLogQueryData.List.$EventHash | Add-Member -MemberType NoteProperty -Name 'NewestEntry' -Value ([string]($event.TimeCreated));
226+
$EventLogQueryData.List.$EventHash | Add-Member -MemberType NoteProperty -Name 'OldestEntry' -Value ([string]($event.TimeCreated));
227+
$EventLogQueryData.List.$EventHash | Add-Member -MemberType NoteProperty -Name 'EventId' -Value ([string]($event.Id));
228+
$EventLogQueryData.List.$EventHash | Add-Member -MemberType NoteProperty -Name 'Message' -Value $EventMessage;
229+
$EventLogQueryData.List.$EventHash | Add-Member -MemberType NoteProperty -Name 'Severity' -Value $ProviderEnums.EventLogSeverityName[$event.Level];
230+
$EventLogQueryData.List.$EventHash | Add-Member -MemberType NoteProperty -Name 'Source' -Value ([string]($event.ProviderName));
231+
$EventLogQueryData.List.$EventHash | Add-Member -MemberType NoteProperty -Name 'Count' -Value 1;
232+
233+
} else {
234+
$EventLogQueryData.List.$EventHash.OldestEntry = ([string]($event.TimeCreated));
235+
$EventLogQueryData.List.$EventHash.Count += 1;
236+
}
237+
238+
if ((Test-PSCustomObjectMember -PSObject $EventLogQueryData.Events -Name $event.Id) -eq $FALSE) {
239+
$EventLogQueryData.Events | Add-Member -MemberType NoteProperty -Name $event.Id -Value 1;
240+
} else {
241+
$EventLogQueryData.Events.($event.Id) += 1;
242+
}
243+
}
244+
245+
if ($null -ne $EventLogEntries) {
246+
$EventLogEntries.Dispose();
247+
}
248+
249+
$EventLogEntries = $null;
250+
$EventLogFilter = $null;
251+
$EventIdFilter = $null;
252+
$EntryTypeFilter = $null;
253+
$SourceFilter = $null;
254+
$UserFilter = $null;
255+
$TimeFilter = $null;
256+
257+
return $EventLogQueryData;
258+
}

0 commit comments

Comments
 (0)