TerribleDev/TimberWinR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Massively decentralized configuration into input and filter classes

Browse Source
This commit is contained in:
Jonathan Preddy
2014-07-22 16:31:00 -04:00
parent e32f5d5adb
commit 5020186bd2
16 changed files with 1410 additions and 1417 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
TimberWinR.ServiceHost/Program.cs
View File

@@ -96,13 +96,13 @@ namespace TimberWinR.ServiceHost
_nlogListener = new TcpInputListener(_cancellationToken, 5140);
outputRedis.Connect(_nlogListener);
foreach (Configuration.IISW3CLog iisw3cConfig in manager.Config.IISW3C)
foreach (Inputs.IISW3CLog iisw3cConfig in manager.Config.IISW3C)
{
var elistner = new IISW3CInputListener(iisw3cConfig, _cancellationToken);
outputRedis.Connect(elistner);
}
foreach (Configuration.WindowsEvent eventConfig in manager.Config.Events)
foreach (Inputs.WindowsEvent eventConfig in manager.Config.Events)
{
var elistner = new WindowsEvtInputListener(eventConfig, _cancellationToken);
outputRedis.Connect(elistner);

1
TimberWinR.ServiceHost/TimberWinR.ServiceHost.csproj
View File

@@ -63,6 +63,7 @@
<ItemGroup>
<Content Include="sampleconf.xml">
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
<SubType>Designer</SubType>
</Content>
</ItemGroup>
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />

6
TimberWinR.UnitTests/Configuration.cs
View File

@@ -229,7 +229,7 @@ namespace TimberWinR.UnitTests
string iCheckpoint;
string binaryFormat = "PRINT";
TimberWinR.Configuration.WindowsEvent evt = c.Events.ToArray()[0];
TimberWinR.Inputs.WindowsEvent evt = c.Events.ToArray()[0];
Assert.AreEqual(source, evt.Source);
Assert.AreEqual(fullText, evt.FullText);
@@ -253,7 +253,7 @@ namespace TimberWinR.UnitTests
bool splitLongLines = false;
string iCheckpoint;
TimberWinR.Configuration.TailFileInput log = c.Logs.ToArray()[0];
TimberWinR.Inputs.TailFileInput log = c.Logs.ToArray()[0];
Assert.AreEqual(name, log.Name);
Assert.AreEqual(location, log.Location);
@@ -307,7 +307,7 @@ namespace TimberWinR.UnitTests
bool consolidateLogs = false;
string iCheckpoint;
TimberWinR.Configuration.IISW3CLog iisw3c = c.IISW3C.ToArray()[0];
TimberWinR.Inputs.IISW3CLog iisw3c = c.IISW3C.ToArray()[0];
Assert.AreEqual(name, iisw3c.Name);
Assert.AreEqual(location, iisw3c.Location);

1291
TimberWinR/Configuration.cs
View File

File diff suppressed because it is too large Load Diff

80
TimberWinR/ConfigurationErrors.cs Normal file
View File

@@ -0,0 +1,80 @@
using System;
using System.Xml;
using System.Xml.Linq;
namespace TimberWinR
{
public class ConfigurationErrors
{
public class MissingRequiredTagException : Exception
{
public MissingRequiredTagException(string tagName)
: base(
string.Format("Missing required tag \"{0}\"", tagName))
{
}
}
public class MissingRequiredAttributeException : Exception
{
public MissingRequiredAttributeException(XElement e, string attributeName)
: base(
string.Format("{0}:{1} Missing required attribute \"{2}\" for element <{3}>", e.Document.BaseUri,
((IXmlLineInfo)e).LineNumber, attributeName, e.Name.ToString()))
{
}
}
public class InvalidAttributeNameException : Exception
{
public InvalidAttributeNameException(XAttribute a)
: base(
string.Format("{0}:{1} Invalid Attribute Name <{2} {3}>", a.Document.BaseUri,
((IXmlLineInfo)a).LineNumber, a.Parent.Name, a.Name.ToString()))
{
}
}
public class InvalidAttributeDateValueException : Exception
{
public InvalidAttributeDateValueException(XAttribute a)
: base(
string.Format(
"{0}:{1} Invalid date format given for attribute. Format must be \"yyyy-MM-dd hh:mm:ss\". <{2} {3}>",
a.Document.BaseUri,
((IXmlLineInfo)a).LineNumber, a.Parent.Name, a.ToString()))
{
}
}
public class InvalidAttributeIntegerValueException : Exception
{
public InvalidAttributeIntegerValueException(XAttribute a)
: base(
string.Format("{0}:{1} Integer value not given for attribute. <{2} {3}>", a.Document.BaseUri,
((IXmlLineInfo)a).LineNumber, a.Parent.Name, a.ToString()))
{
}
}
public class InvalidAttributeValueException : Exception
{
public InvalidAttributeValueException(XAttribute a)
: base(
string.Format("{0}:{1} Invalid Attribute Value <{2} {3}>", a.Document.BaseUri,
((IXmlLineInfo)a).LineNumber, a.Parent.Name, a.ToString()))
{
}
}
public class InvalidElementNameException : Exception
{
public InvalidElementNameException(XElement e)
: base(
string.Format("{0}:{1} Invalid Element Name <{2}> <{3}>", e.Document.BaseUri,
((IXmlLineInfo)e).LineNumber, e.Parent.Name, e.ToString()))
{
}
}
}
}

140
TimberWinR/Filters/DateFilter.cs
View File

@@ -1,10 +1,10 @@
using Newtonsoft.Json.Linq;
using System;
using System;
using System.Collections.Generic;
using System.Globalization;
using System.Linq;
using System.Text;
using Newtonsoft.Json.Linq;
using System.Xml.Linq;
namespace TimberWinR.Filters
{
@@ -15,12 +15,88 @@ namespace TimberWinR.Filters
public bool ConvertToUTC { get; private set; }
public List<string> Patterns { get; private set; }
public DateFilter(Params_DateFilter args)
public static void Parse(List<FilterBase> filters, XElement dateElement)
{
Field = args.Field;
Target = args.Target;
ConvertToUTC = args.ConvertToUTC;
Patterns = args.Patterns;
filters.Add(parseDate(dateElement));
}
static DateFilter parseDate(XElement e)
{
return new DateFilter(e);
}
DateFilter(XElement parent)
{
Patterns = new List<string>();
ParseField(parent);
ParseTarget(parent);
ParseConvertToUTC(parent);
ParsePatterns(parent);
}
private void ParseField(XElement parent)
{
string attributeName = "field";
try
{
XAttribute a = parent.Attribute(attributeName);
Field = a.Value;
}
catch
{
}
}
private void ParseTarget(XElement parent)
{
string attributeName = "field";
try
{
XAttribute a = parent.Attribute(attributeName);
Field = a.Value;
}
catch
{
}
}
private void ParseConvertToUTC(XElement parent)
{
string attributeName = "convertToUTC";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ON" || value == "true")
{
ConvertToUTC = true;
}
else if (value == "OFF" || value == "false")
{
ConvertToUTC = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParsePatterns(XElement parent)
{
foreach (var e in parent.Elements("Pattern"))
{
string pattern = e.Value;
Patterns.Add(pattern);
}
}
public override string ToString()
@@ -73,55 +149,5 @@ namespace TimberWinR.Filters
json[Target] = ts;
}
public class Params_DateFilter
{
public string Field { get; private set; }
public string Target { get; private set; }
public bool ConvertToUTC { get; private set; }
public List<string> Patterns { get; private set; }
public class Builder
{
private string field;
private string target;
private bool convertToUTC = false;
private List<string> patterns;
public Builder WithField(string value)
{
field = value;
return this;
}
public Builder WithTarget(string value)
{
target = value;
return this;
}
public Builder WithConvertToUTC(bool value)
{
convertToUTC = value;
return this;
}
public Builder WithPattern(string value)
{
patterns.Add(value);
return this;
}
public Params_DateFilter Build()
{
return new Params_DateFilter()
{
Field = field,
Target = target,
ConvertToUTC = convertToUTC,
Patterns = patterns
};
}
}
}
}
}

198
TimberWinR/Filters/GrokFilter.cs
View File

@@ -6,24 +6,143 @@ using System.Globalization;
using System.Linq;
using System.Text;
using System.Text.RegularExpressions;
using System.Xml.Linq;
namespace TimberWinR.Filters
{
public class GrokFilter : FilterBase
{
public const string TagName = "Grok";
public string Match { get; private set; }
public string Field { get; private set; }
public Pair AddField { get; private set; }
public List<FieldValuePair> AddFields { get; private set; }
public bool DropIfMatch { get; private set; }
public string RemoveField { get; private set; }
public List<string> RemoveFields { get; private set; }
public GrokFilter(Params_GrokFilter args)
public static void Parse(List<FilterBase> filters, XElement grokElement)
{
Match = args.Match;
Field = args.Field;
AddField = args.AddField;
DropIfMatch = args.DropIfMatch;
RemoveField = args.RemoveField;
filters.Add(parseGrok(grokElement));
}
static GrokFilter parseGrok(XElement e)
{
return new GrokFilter(e);
}
GrokFilter(XElement parent)
{
AddFields = new List<FieldValuePair>();
RemoveFields = new List<string>();
ParseMatch(parent);
ParseAddFields(parent);
ParseDropIfMatch(parent);
ParseRemoveFields(parent);
}
private void ParseMatch(XElement parent)
{
XElement e = parent.Element("Match");
if (e != null)
{
string attributeName = "value";
try
{
Match = e.Attribute(attributeName).Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(e, attributeName);
}
}
}
private void ParseAddFields(XElement parent)
{
foreach (var e in parent.Elements("AddField"))
{
string attributeName = "field";
string field, value;
try
{
field = e.Attribute(attributeName).Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(e, attributeName);
}
attributeName = "value";
try
{
value = e.Attribute(attributeName).Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(e, attributeName);
}
FieldValuePair a = new FieldValuePair(field, value);
AddFields.Add(a);
}
}
private void ParseDropIfMatch(XElement parent)
{
XElement e = parent.Element("DropIfMatch");
if (e != null)
{
string attributeName = "value";
string value;
try
{
value = e.Attribute(attributeName).Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(e, attributeName);
}
if (value == "ON" || value == "true")
{
DropIfMatch = true;
}
else if (value == "OFF" || value == "false")
{
DropIfMatch = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(e.Attribute(attributeName));
}
}
}
private void ParseRemoveFields(XElement parent)
{
foreach (var e in parent.Elements("RemoveField"))
{
if (e != null)
{
string attributeName = "value";
string value;
try
{
value = e.Attribute(attributeName).Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(e, attributeName);
}
RemoveFields.Add(e.Attribute("value").Value);
}
}
}
public override string ToString()
@@ -73,66 +192,15 @@ namespace TimberWinR.Filters
json[fieldName] = fieldValue;
}
public class Params_GrokFilter
public class FieldValuePair
{
public string Match { get; private set; }
public string Field { get; private set; }
public Pair AddField { get; private set; }
public bool DropIfMatch { get; private set; }
public string RemoveField { get; private set; }
public string Field { get; set; }
public string Value { get; set; }
public class Builder
public FieldValuePair(string field, string value)
{
private string match;
private string field;
private Pair addField;
private bool dropIfMatch = false;
private string removeField;
public Builder WithField(string value)
{
field = value;
return this;
}
public Builder WithMatch(string value)
{
match = value;
return this;
}
public Builder WithAddField(Pair value)
{
addField = value;
return this;
}
public Builder WithDropIfMatch(bool value)
{
dropIfMatch = value;
return this;
}
public Builder WithRemoveField(string value)
{
removeField = value;
return this;
}
public Params_GrokFilter Build()
{
return new Params_GrokFilter()
{
Match = match,
Field = field,
AddField = addField,
DropIfMatch = dropIfMatch,
RemoveField = removeField
};
}
Field = field;
Value = value;
}
}
}

229
TimberWinR/Inputs/IISLog.cs Normal file
View File

@@ -0,0 +1,229 @@
using System;
using System.Collections.Generic;
using System.Globalization;
using System.Text;
using System.Xml.Linq;
namespace TimberWinR.Inputs
{
public class IISLog : InputBase
{
public string Name { get; private set; }
public string Location { get; private set; }
public List<FieldDefinition> Fields { get; private set; }
// Parameters
public int ICodepage { get; private set; }
public int Recurse { get; private set; }
public string MinDateMod { get; private set; }
public string Locale { get; private set; }
public string ICheckpoint { get; private set; }
public static void Parse(List<IISLog> iislogs, XElement iislogElement)
{
iislogs.Add(parseIISLog(iislogElement));
}
static IISLog parseIISLog(XElement e)
{
return new IISLog(e);
}
public IISLog(XElement parent)
{
ParseName(parent);
ParseLocation(parent);
// Default values for parameters.
ICodepage = -2;
Recurse = 0;
Locale = "DEF";
ParseICodepage(parent);
ParseRecurse(parent);
ParseMinDateMod(parent);
ParseLocale(parent);
ParseICheckpoint(parent);
ParseFields(parent);
}
private void ParseName(XElement parent)
{
string attributeName = "name";
try
{
XAttribute a = parent.Attribute(attributeName);
Name = a.Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(parent, attributeName);
}
}
private void ParseLocation(XElement parent)
{
string attributeName = "location";
try
{
XAttribute a = parent.Attribute(attributeName);
Location = a.Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(parent, attributeName);
}
}
private void ParseICodepage(XElement parent)
{
string attributeName = "iCodepage";
int valInt;
try
{
XAttribute a = parent.Attribute(attributeName);
if (int.TryParse(a.Value, out valInt))
{
ICodepage = valInt;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeIntegerValueException(a);
}
}
catch
{
}
}
private void ParseRecurse(XElement parent)
{
string attributeName = "recurse";
int valInt;
try
{
XAttribute a = parent.Attribute(attributeName);
if (int.TryParse(a.Value, out valInt))
{
Recurse = valInt;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeIntegerValueException(a);
}
}
catch
{
}
}
private void ParseMinDateMod(XElement parent)
{
string attributeName = "minDateMod";
try
{
XAttribute a = parent.Attribute(attributeName);
DateTime dt;
if (DateTime.TryParseExact(a.Value,
"yyyy-MM-dd hh:mm:ss",
CultureInfo.InvariantCulture,
DateTimeStyles.None,
out dt))
{
MinDateMod = a.Value;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeDateValueException(a);
}
Locale = a.Value;
}
catch { }
}
private void ParseLocale(XElement parent)
{
string attributeName = "locale";
try
{
XAttribute a = parent.Attribute(attributeName);
Locale = a.Value;
}
catch { }
}
private void ParseICheckpoint(XElement parent)
{
string attributeName = "iCheckpoint";
try
{
XAttribute a = parent.Attribute(attributeName);
ICheckpoint = a.Value;
}
catch { }
}
private void ParseFields(XElement parent)
{
Dictionary<string, Type> allPossibleFields = new Dictionary<string, Type>()
{
{ "LogFilename", typeof(string) },
{ "LogRow", typeof(int) },
{ "UserIP", typeof(string) },
{ "UserName", typeof(string) },
{ "Date", typeof(DateTime) },
{ "Time", typeof(DateTime) },
{ "ServiceInstance", typeof(string) },
{ "HostName", typeof(string) },
{ "ServerIP", typeof(string) },
{ "TimeTaken", typeof(int) },
{ "BytesSent", typeof(int) },
{ "BytesReceived", typeof(int) },
{ "StatusCode", typeof(int) },
{ "Win32StatusCode", typeof(int) },
{ "RequestType", typeof(string) },
{ "Target", typeof(string) },
{ "Parameters", typeof(string) }
};
Fields = base.parseFields(parent, allPossibleFields);
}
public override string ToString()
{
StringBuilder sb = new StringBuilder();
sb.Append("IISLog\n");
sb.Append(String.Format("Name: {0}\n", Name));
sb.Append(String.Format("Location: {0}\n", Location));
sb.Append("Fields:\n");
foreach (FieldDefinition f in Fields)
{
sb.Append(String.Format("\t{0}\n", f.Name));
}
sb.Append("Parameters:\n");
sb.Append(String.Format("\tiCodepage: {0}\n", ICodepage));
sb.Append(String.Format("\trecurse: {0}\n", Recurse));
sb.Append(String.Format("\tminDateMod: {0}\n", MinDateMod));
sb.Append(String.Format("\tlocale: {0}\n", Locale));
sb.Append(String.Format("\tiCheckpoint: {0}\n", ICheckpoint));
return sb.ToString();
}
}
}

4
TimberWinR/Inputs/IISW3CInputListener.cs
View File

@@ -21,10 +21,10 @@ namespace TimberWinR.Inputs
public class IISW3CInputListener : InputListener
{
private int _pollingIntervalInSeconds = 1;
private TimberWinR.Configuration.IISW3CLog _arguments;
private TimberWinR.Inputs.IISW3CLog _arguments;
public IISW3CInputListener(TimberWinR.Configuration.IISW3CLog arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 1)
public IISW3CInputListener(TimberWinR.Inputs.IISW3CLog arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 1)
: base(cancelToken)
{
_arguments = arguments;

291
TimberWinR/Inputs/IISW3CLog.cs Normal file
View File

@@ -0,0 +1,291 @@
using System;
using System.Collections.Generic;
using System.Text;
using System.Xml.Linq;
namespace TimberWinR.Inputs
{
public class IISW3CLog : InputBase
{
public string Name { get; private set; }
public string Location { get; private set; }
public List<FieldDefinition> Fields { get; private set; }
// Parameters
public int ICodepage { get; private set; }
public int Recurse { get; private set; }
public string MinDateMod { get; private set; }
public bool DQuotes { get; private set; }
public bool DirTime { get; private set; }
public bool ConsolidateLogs { get; private set; }
public string ICheckpoint { get; private set; }
public static void Parse(List<IISW3CLog> iisw3clogs, XElement iisw3clogElement)
{
iisw3clogs.Add(parseIISW3CLog(iisw3clogElement));
}
static IISW3CLog parseIISW3CLog(XElement e)
{
return new IISW3CLog(e);
}
public IISW3CLog(XElement parent)
{
ParseName(parent);
ParseLocation(parent);
// Default values for parameters.
ICodepage = -2;
Recurse = 0;
DQuotes = false;
DirTime = false;
ConsolidateLogs = false;
ParseICodepage(parent);
ParseRecurse(parent);
ParseDQuotes(parent);
ParseDirTime(parent);
ParseConsolidateLogs(parent);
ParseICheckpoint(parent);
ParseFields(parent);
}
private void ParseName(XElement parent)
{
string attributeName = "name";
try
{
XAttribute a = parent.Attribute(attributeName);
Name = a.Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(parent, attributeName);
}
}
private void ParseLocation(XElement parent)
{
string attributeName = "location";
try
{
XAttribute a = parent.Attribute(attributeName);
Location = a.Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(parent, attributeName);
}
}
private void ParseICodepage(XElement parent)
{
string attributeName = "iCodepage";
int valInt;
try
{
XAttribute a = parent.Attribute(attributeName);
if (int.TryParse(a.Value, out valInt))
{
ICodepage = valInt;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeIntegerValueException(a);
}
}
catch
{
}
}
private void ParseRecurse(XElement parent)
{
string attributeName = "recurse";
int valInt;
try
{
XAttribute a = parent.Attribute(attributeName);
if (int.TryParse(a.Value, out valInt))
{
Recurse = valInt;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeIntegerValueException(a);
}
}
catch
{
}
}
private void ParseDQuotes(XElement parent)
{
string attributeName = "dQuotes";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ON" || value == "true")
{
DQuotes = true;
}
else if (value == "OFF" || value == "false")
{
DQuotes = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseDirTime(XElement parent)
{
string attributeName = "dirTime";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ON" || value == "true")
{
DirTime = true;
}
else if (value == "OFF" || value == "false")
{
DirTime = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseConsolidateLogs(XElement parent)
{
string attributeName = "consolidateLogs";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ON" || value == "true")
{
ConsolidateLogs = true;
}
else if (value == "OFF" || value == "false")
{
ConsolidateLogs = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseICheckpoint(XElement parent)
{
string attributeName = "iCheckpoint";
try
{
XAttribute a = parent.Attribute(attributeName);
ICheckpoint = a.Value;
}
catch { }
}
private void ParseFields(XElement parent)
{
Dictionary<string, Type> allPossibleFields = new Dictionary<string, Type>()
{
{ "LogFilename", typeof(string) },
{ "LogRow", typeof(int) },
{ "date", typeof(DateTime) },
{ "time", typeof(DateTime) },
{ "c-ip", typeof(string) },
{ "cs-username", typeof(string) },
{ "s-sitename", typeof(string) },
{ "s-computername", typeof(int) },
{ "s-ip", typeof(string) },
{ "s-port", typeof(int) },
{ "cs-method", typeof(string) },
{ "cs-uri-stem", typeof(string) },
{ "cs-uri-query", typeof(string) },
{ "sc-status", typeof(int) },
{ "sc-substatus", typeof(int) },
{ "sc-win32-status", typeof(int) },
{ "sc-bytes", typeof(int) },
{ "cs-bytes", typeof(int) },
{ "time-taken", typeof(int) },
{ "cs-version", typeof(string) },
{ "cs-host", typeof(string) },
{ "cs(User-Agent)", typeof(string) },
{ "cs(Cookie)", typeof(string) },
{ "cs(Referer)", typeof(string) },
{ "s-event", typeof(string) },
{ "s-process-type", typeof(string) },
{ "s-user-time", typeof(double) },
{ "s-kernel-time", typeof(double) },
{ "s-page-faults", typeof(int) },
{ "s-total-procs", typeof(int) },
{ "s-active-procs", typeof(int) },
{ "s-stopped-procs", typeof(int) }
};
Fields = base.parseFields(parent, allPossibleFields);
}
public override string ToString()
{
StringBuilder sb = new StringBuilder();
sb.Append("IISW3CLog\n");
sb.Append(String.Format("Name: {0}\n", Name));
sb.Append(String.Format("Location: {0}\n", Location));
sb.Append("Fields:\n");
foreach (FieldDefinition f in Fields)
{
sb.Append(String.Format("\t{0}\n", f.Name));
}
sb.Append("Parameters:\n");
sb.Append(String.Format("\tiCodepage: {0}\n", ICodepage));
sb.Append(String.Format("\trecurse: {0}\n", Recurse));
sb.Append(String.Format("\tminDateMod: {0}\n", MinDateMod));
sb.Append(String.Format("\tdQuotes: {0}\n", DQuotes));
sb.Append(String.Format("\tdirTime: {0}\n", DirTime));
sb.Append(String.Format("\tconsolidateLogs: {0}\n", ConsolidateLogs));
sb.Append(String.Format("\tiCheckpoint: {0}\n", ICheckpoint));
return sb.ToString();
}
}
}

56
TimberWinR/Inputs/InputBase.cs Normal file
View File

@@ -0,0 +1,56 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Xml.Linq;
namespace TimberWinR.Inputs
{
public abstract class InputBase
{
internal List<FieldDefinition> parseFields(XElement parent, Dictionary<string, Type> allPossibleFields)
{
IEnumerable<XElement> xml_fields =
from el in parent.Elements("Fields").Elements("Field")
select el;
List<FieldDefinition> fields = new List<FieldDefinition>();
foreach (XElement f in xml_fields)
{
// Parse field name.
string name;
string attributeName = "name";
try
{
name = f.Attribute(attributeName).Value;
}
catch (NullReferenceException)
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(f, attributeName);
}
// Ensure field name is valid.
if (allPossibleFields.ContainsKey(name))
{
fields.Add(new FieldDefinition(name, allPossibleFields[name]));
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(f.Attribute("name"));
}
}
// If no fields are provided, default to all fields.
if (fields.Count == 0)
{
foreach (KeyValuePair<string, Type> entry in allPossibleFields)
{
fields.Add(new FieldDefinition(entry.Key, entry.Value));
}
}
return fields;
}
}
}

198
TimberWinR/Inputs/TailFileInput.cs Normal file
View File

@@ -0,0 +1,198 @@
using System;
using System.Collections.Generic;
using System.Text;
using System.Xml.Linq;
namespace TimberWinR.Inputs
{
public class TailFileInput : InputBase
{
public string Name { get; private set; }
public string Location { get; private set; }
public List<FieldDefinition> Fields { get; private set; }
// Parameters
public int ICodepage { get; private set; }
public int Recurse { get; private set; }
public bool SplitLongLines { get; private set; }
public string ICheckpoint { get; private set; }
public static void Parse(List<TailFileInput> logs, XElement logElement)
{
logs.Add(parseLog(logElement));
}
static TailFileInput parseLog(XElement e)
{
return new TailFileInput(e);
}
public TailFileInput(XElement parent)
{
ParseName(parent);
ParseLocation(parent);
// Default values for parameters.
ICodepage = 0;
Recurse = 0;
SplitLongLines = false;
ParseICodepage(parent);
ParseRecurse(parent);
ParseSplitLongLines(parent);
ParseICheckpoint(parent);
ParseFields(parent);
}
private void ParseName(XElement parent)
{
string attributeName = "name";
try
{
XAttribute a = parent.Attribute(attributeName);
Name = a.Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(parent, attributeName);
}
}
private void ParseLocation(XElement parent)
{
string attributeName = "location";
try
{
XAttribute a = parent.Attribute(attributeName);
Location = a.Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(parent, attributeName);
}
}
private void ParseICodepage(XElement parent)
{
string attributeName = "iCodepage";
int valInt;
try
{
XAttribute a = parent.Attribute(attributeName);
if (int.TryParse(a.Value, out valInt))
{
ICodepage = valInt;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeIntegerValueException(a);
}
}
catch
{
}
}
private void ParseRecurse(XElement parent)
{
string attributeName = "recurse";
int valInt;
try
{
XAttribute a = parent.Attribute(attributeName);
if (int.TryParse(a.Value, out valInt))
{
Recurse = valInt;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeIntegerValueException(a);
}
}
catch
{
}
}
private void ParseSplitLongLines(XElement parent)
{
string attributeName = "splitLongLines";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ON" || value == "true")
{
SplitLongLines = true;
}
else if (value == "OFF" || value == "false")
{
SplitLongLines = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseICheckpoint(XElement parent)
{
string attributeName = "iCheckpoint";
try
{
XAttribute a = parent.Attribute(attributeName);
ICheckpoint = a.Value;
}
catch { }
}
private void ParseFields(XElement parent)
{
Dictionary<string, Type> allPossibleFields = new Dictionary<string, Type>()
{
{ "LogFilename", typeof(string) },
{ "Index", typeof(int) },
{ "Text", typeof(string) }
};
Fields = base.parseFields(parent, allPossibleFields);
}
public override string ToString()
{
StringBuilder sb = new StringBuilder();
sb.Append("TextLog\n");
sb.Append(String.Format("Name: {0}\n", Name));
sb.Append(String.Format("Location: {0}\n", Location));
sb.Append("Fields:\n");
foreach (FieldDefinition f in Fields)
{
sb.Append(String.Format("\t{0}\n", f.Name));
}
sb.Append("Parameters:\n");
sb.Append(String.Format("\tiCodepage: {0}\n", ICodepage));
sb.Append(String.Format("\trecurse: {0}\n", Recurse));
sb.Append(String.Format("\tsplitLongLines: {0}\n", SplitLongLines));
sb.Append(String.Format("\tiCheckpoint: {0}\n", ICheckpoint));
return sb.ToString();
}
}
}

4
TimberWinR/Inputs/TailFileInputListener.cs
View File

@@ -23,9 +23,9 @@ namespace TimberWinR.Inputs
public class TailFileInputListener : InputListener
{
private int _pollingIntervalInSeconds = 1;
private TimberWinR.Configuration.TailFileInput _arguments;
private TimberWinR.Inputs.TailFileInput _arguments;
public TailFileInputListener(TimberWinR.Configuration.TailFileInput arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 1)
public TailFileInputListener(TimberWinR.Inputs.TailFileInput arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 1)
: base(cancelToken)
{
_arguments = arguments;

315
TimberWinR/Inputs/WindowsEvent.cs Normal file
View File

@@ -0,0 +1,315 @@
using System;
using System.Collections.Generic;
using System.Text;
using System.Xml.Linq;
namespace TimberWinR.Inputs
{
public class WindowsEvent : InputBase
{
public string Source { get; private set; }
public List<FieldDefinition> Fields { get; private set; }
// Parameters
public bool FullText { get; private set; }
public bool ResolveSIDS { get; private set; }
public bool FormatMsg { get; private set; }
public string MsgErrorMode { get; private set; }
public bool FullEventCode { get; private set; }
public string Direction { get; private set; }
public string StringsSep { get; private set; }
public string ICheckpoint { get; private set; }
public string BinaryFormat { get; private set; }
public static void Parse(List<WindowsEvent> events, XElement eventElement)
{
events.Add(parseEvent(eventElement));
}
static WindowsEvent parseEvent(XElement e)
{
return new WindowsEvent(e);
}
WindowsEvent(XElement parent)
{
ParseSource(parent);
// Default values for parameters.
FullText = true;
ResolveSIDS = true;
FormatMsg = true;
MsgErrorMode = "MSG";
FullEventCode = false;
Direction = "FW";
StringsSep = "|";
BinaryFormat = "PRINT";
ParseFullText(parent);
ParseResolveSIDS(parent);
ParseFormatMsg(parent);
ParseMsgErrorMode(parent);
ParseFullEventCode(parent);
ParseDirection(parent);
ParseStringsSep(parent);
ParseBinaryFormat(parent);
ParseFields(parent);
}
private void ParseSource(XElement parent)
{
string attributeName = "source";
try
{
XAttribute a = parent.Attribute(attributeName);
Source = a.Value;
}
catch
{
throw new TimberWinR.ConfigurationErrors.MissingRequiredAttributeException(parent, attributeName);
}
}
private void ParseFullText(XElement parent)
{
string attributeName = "fullText";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ON" || value == "true")
{
FullText = true;
}
else if (value == "OFF" || value == "false")
{
FullText = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseResolveSIDS(XElement parent)
{
string attributeName = "resolveSIDS";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ON" || value == "true")
{
ResolveSIDS = true;
}
else if (value == "OFF" || value == "false")
{
ResolveSIDS = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseFormatMsg(XElement parent)
{
string attributeName = "formatMsg";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ON" || value == "true")
{
FormatMsg = true;
}
else if (value == "OFF" || value == "false")
{
FormatMsg = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseMsgErrorMode(XElement parent)
{
string attributeName = "msgErrorMode";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "NULL" || value == "ERROR" || value == "MSG")
{
MsgErrorMode = value;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseFullEventCode(XElement parent)
{
string attributeName = "fullEventCode";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ON" || value == "true")
{
FullEventCode = true;
}
else if (value == "OFF" || value == "false")
{
FullEventCode = false;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseDirection(XElement parent)
{
string attributeName = "direction";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "FW" || value == "BW")
{
Direction = value;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseStringsSep(XElement parent)
{
string attributeName = "stringsSep";
try
{
XAttribute a = parent.Attribute(attributeName);
StringsSep = a.Value;
}
catch { }
}
private void ParseBinaryFormat(XElement parent)
{
string attributeName = "binaryFormat";
string value;
try
{
XAttribute a = parent.Attribute(attributeName);
value = a.Value;
if (value == "ASC" || value == "PRINT" || value == "HEX")
{
BinaryFormat = value;
}
else
{
throw new TimberWinR.ConfigurationErrors.InvalidAttributeValueException(parent.Attribute(attributeName));
}
}
catch { }
}
private void ParseFields(XElement parent)
{
Dictionary<string, Type> allPossibleFields = new Dictionary<string, Type>()
{
{ "EventLog", typeof(string) },
{ "RecordNumber", typeof(int) },
{ "TimeGenerated", typeof(DateTime) },
{ "TimeWritten", typeof(DateTime) },
{ "EventID", typeof(int) },
{ "EventType", typeof(int) },
{ "EventTypeName", typeof(string) },
{ "EventCategory", typeof(int) },
{ "EventCategoryName", typeof(string) },
{ "SourceName", typeof(string) },
{ "Strings", typeof(string) },
{ "ComputerName", typeof(string) },
{ "SID", typeof(string) },
{ "Message", typeof(string) },
{ "Data", typeof(string) }
};
Fields = base.parseFields(parent, allPossibleFields);
}
public override string ToString()
{
StringBuilder sb = new StringBuilder();
sb.Append("WindowsEvent\n");
sb.Append(String.Format("Source: {0}\n", Source));
sb.Append("Fields:\n");
foreach (FieldDefinition f in Fields)
{
sb.Append(String.Format("\t{0}\n", f.Name));
}
sb.Append("Parameters:\n");
sb.Append(String.Format("\tfullText: {0}\n", FullText));
sb.Append(String.Format("\tresolveSIDS: {0}\n", ResolveSIDS));
sb.Append(String.Format("\tformatMsg: {0}\n", FormatMsg));
sb.Append(String.Format("\tmsgErrorMode: {0}\n", MsgErrorMode));
sb.Append(String.Format("\tfullEventCode: {0}\n", FullEventCode));
sb.Append(String.Format("\tdirection: {0}\n", Direction));
sb.Append(String.Format("\tstringsSep: {0}\n", StringsSep));
sb.Append(String.Format("\tiCheckpoint: {0}\n", ICheckpoint));
sb.Append(String.Format("\tbinaryFormat: {0}\n", BinaryFormat));
return sb.ToString();
}
}
}

4
TimberWinR/Inputs/WindowsEvtInputListener.cs
View File

@@ -23,9 +23,9 @@ namespace TimberWinR.Inputs
public class WindowsEvtInputListener : InputListener
{
private int _pollingIntervalInSeconds = 1;
private TimberWinR.Configuration.WindowsEvent _arguments;
private TimberWinR.Inputs.WindowsEvent _arguments;
public WindowsEvtInputListener(TimberWinR.Configuration.WindowsEvent arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 1)
public WindowsEvtInputListener(TimberWinR.Inputs.WindowsEvent arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 1)
: base(cancelToken)
{
_arguments = arguments;

6
TimberWinR/TimberWinR.csproj
View File

@@ -64,16 +64,22 @@
</ItemGroup>
<ItemGroup>
<Compile Include="Configuration.cs" />
<Compile Include="ConfigurationErrors.cs" />
<Compile Include="Filters\DateFilter.cs" />
<Compile Include="Filters\FilterBase.cs" />
<Compile Include="Filters\GrokFilter.cs" />
<Compile Include="Filters\MutateFilter.cs" />
<Compile Include="Inputs\FieldDefinitions.cs" />
<Compile Include="Inputs\IISLog.cs" />
<Compile Include="Inputs\IISW3CInputListener.cs" />
<Compile Include="Inputs\IISW3CLog.cs" />
<Compile Include="Inputs\InputBase.cs" />
<Compile Include="Inputs\InputListener.cs" />
<Compile Include="Inputs\ParameterDefinitions.cs" />
<Compile Include="Inputs\TailFileInput.cs" />
<Compile Include="Inputs\TcpInputListener.cs" />
<Compile Include="Inputs\TailFileInputListener.cs" />
<Compile Include="Inputs\WindowsEvent.cs" />
<Compile Include="Inputs\WindowsEvtInputListener.cs" />
<Compile Include="Manager.cs" />
<Compile Include="Outputs\OutputSender.cs" />