Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Subscribe to power events on Windows #1248

Merged
merged 11 commits into from
Jul 12, 2023

Conversation

RebeccaMahany
Copy link
Contributor

@RebeccaMahany RebeccaMahany commented Jul 6, 2023

Uses EvtSubscribe to receive notifications when we enter or leave modern standby.

When looking at the sleep report for my computer, I noticed that on lid shut or sleep, the device entered Modern Standby immediately (event ID 506). On resume, it would exit Modern Standby (507).

After many hours in Modern Standby, the device would exit Modern Standby (507) with Reason: Sleep, Hibernate, or Shutdown, and immediately enter sleep (42) with reason Hibernate from Sleep - Standby Battery Budget Exceeded. On wake, it would re-enter (506) and then exit (507) Modern Standby.

stateDiagram-v2
    Awake --> ModernStandby: 506
    ModernStandby --> Awake: 507
    ModernStandby --> Sleep: 507 => 42
    Sleep --> ModernStandby: 506
Loading

Copy link
Contributor

@directionless directionless left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I read this correctly, it's subscribing to the windows events.

Any thoughts about that approach vs setting up a callback on DAM actions? The bottom of https://learn.microsoft.com/en-us/windows/compatibility/desktop-activity-moderator has a solution section about how to do this with windows notifications.

cmd/launcher/svc_watcher_windows.go Outdated Show resolved Hide resolved
@RebeccaMahany
Copy link
Contributor Author

RebeccaMahany commented Jul 10, 2023

@directionless

If I read this correctly, it's subscribing to the windows events.

Yes -- I found this was more reliable/useful than registering the service to receive power events.

Any thoughts about that approach vs setting up a callback on DAM actions? The bottom of https://learn.microsoft.com/en-us/windows/compatibility/desktop-activity-moderator has a solution section about how to do this with windows notifications.

A couple places I read (comment on this answer, this answer that links to this official post) indicated that PowerRegisterSuspendResumeNotification maybe would not work -- I hadn't given it a shot given that and given how much time it took to get this option to work. I can try it this week to confirm, though -- it looks like all of those links are fairly old so maybe something has changed in the meantime. (I did try the option linked in the official post and couldn't get that to work either.)

@directionless
Copy link
Contributor

Any thoughts about that approach vs setting up a callback on DAM actions? The bottom of https://learn.microsoft.com/en-us/windows/compatibility/desktop-activity-moderator has a solution section about how to do this with windows notifications.

A couple places I read (comment on this answer, this answer that links to this official post) indicated that PowerRegisterSuspendResumeNotification maybe would not work -- I hadn't given it a shot given that and given how much time it took to get this option to work. I can try it this week to confirm, though -- it looks like all of those links are fairly old so maybe something has changed in the meantime. (I did try the option linked in the official post and couldn't get that to work either.)

I don't know enough to know which approach is more "supported". I do not currently have strong opinions.

@RebeccaMahany RebeccaMahany marked this pull request as ready for review July 10, 2023 21:22
directionless
directionless previously approved these changes Jul 10, 2023
Copy link
Contributor

@directionless directionless left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems okay to try

pkg/windows/eventwatcher/power_event_watcher_windows.go Outdated Show resolved Hide resolved
Comment on lines 59 to 62
if err != nil {
level.Debug(p.logger).Log("msg", "error creating pointer to channel path", "err", err)
return
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hrm. I wonder if we should log and return, or return the error. Feels a little TBD.

This feels a bit like our usual go actors -- and we should return the error. Though we might end up ignoring it at the caller level

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was also thinking this should maybe just be a rungroup actor, and that's why I was waffling on the error handling here -- because I didn't want to return an error on the equivalent of Execute and force a launcher restart, since this is just for logging right now.

I think the option that feels the most consistent to me is to move this setup work into the New function, and return an error on failure to set up. If New returns an error, log it and move on; if it doesn't, add the rungroup with a no-op Execute. Does that sound reasonable?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pushed this change, lmk what you think!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. I think that pattern is good.

New returns an error, and the caller decides if it's fatal. And after that, it's in it's own little world.

James-Pickett
James-Pickett previously approved these changes Jul 11, 2023
@James-Pickett
Copy link
Contributor

so we just plan to log the events for now? not actually acting on them?

@directionless
Copy link
Contributor

so we just plan to log the events for now? not actually acting on them?

Yeah. Partly because I want to get this to customer to see if it's what's happening. And I think actioning them might be tricky. So get this out, then work on what's next

directionless
directionless previously approved these changes Jul 11, 2023
Copy link
Contributor

@directionless directionless left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd take it

pkg/windows/eventwatcher/power_event_watcher_other.go Outdated Show resolved Hide resolved
Comment on lines 95 to 99
// Execute is a no-op, since we've already registered our subscription
func (p *powerEventWatcher) Execute() error {
<-p.interrupt
return nil
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feels like a lot of New should move here. But probably doesn't matter yet

@RebeccaMahany RebeccaMahany merged commit 5d53015 into kolide:main Jul 12, 2023
14 checks passed
@RebeccaMahany RebeccaMahany deleted the becca/watch-power-events branch July 12, 2023 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants