Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

in_winevtlog: Display error on invalid subscription state #8544

Merged

Conversation

cosmo0920
Copy link
Contributor

@cosmo0920 cosmo0920 commented Mar 2, 2024

Fluent Bit is also using pull subscription model for collecting Windows EventLog. Through a registered signal, we're able to obtain the internal state of EvtSubscribe API.
Like as fluent-plugins-nursery/winevt_c#44 fix, Fluent Bit can be made to detect the failure of the subscription.
We need to check it for more strict approach to handle subscription for EventLog.
When failed status is returned from a registered signal, we should recreate the subscription if possible.

This signal approach is inspired from the article: https://learn.microsoft.com/en-us/windows/win32/wes/subscribing-to-events#pull-subscriptions
This article describes that when using the pull type of subscription, EvtSubscribe can tell whether Windows EventLogs are collected or not via a registered signal.


Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

  • Example configuration file for the change
  • Debug log output from testing the change
  • Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

  • Run local packaging test showing all targets (including any new ones) build.
  • Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

  • Documentation required for this feature

Backporting

  • Backport to latest stable release.

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
@cosmo0920 cosmo0920 changed the title in_winevtlog: Display error on invalid subscription state in_winevtlog: Try to recreate subscription if signal event returns failed status Mar 2, 2024
@cosmo0920 cosmo0920 force-pushed the cosmo0920-winevtlog-display-error-when-subscription-is-invalid branch from d2cb767 to 7a60df0 Compare March 2, 2024 07:45
@cosmo0920 cosmo0920 marked this pull request as ready for review March 5, 2024 03:23
@cosmo0920 cosmo0920 force-pushed the cosmo0920-winevtlog-display-error-when-subscription-is-invalid branch from 7a60df0 to 0bd350d Compare March 5, 2024 03:26
@cosmo0920 cosmo0920 marked this pull request as draft March 6, 2024 01:43
…alid status

Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
@cosmo0920 cosmo0920 force-pushed the cosmo0920-winevtlog-display-error-when-subscription-is-invalid branch from 0bd350d to fbaedef Compare March 6, 2024 02:58
@cosmo0920 cosmo0920 marked this pull request as ready for review March 6, 2024 03:04
@cosmo0920
Copy link
Contributor Author

I resync implementation on this PR what winevt_c's PR does. I tested to try to make invalid status but the event signal does not respond for stale of EvtSubscribe. Checking WAIT_FAILED brunch is just for needed for the possibility to be returned from WaitForSingleObject Windows API.

@cosmo0920 cosmo0920 changed the title in_winevtlog: Try to recreate subscription if signal event returns failed status in_winevtlog: Display error on invalid subscription state Mar 6, 2024
@edsiper edsiper merged commit acc1805 into master Mar 14, 2024
46 checks passed
@edsiper edsiper deleted the cosmo0920-winevtlog-display-error-when-subscription-is-invalid branch March 14, 2024 21:44
@edsiper edsiper added this to the Fluent Bit v3.0.0 milestone Mar 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants