TerribleDev/TimberWinR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use fields from definition

Browse Source
This commit is contained in:
Eric Fontana
2014-07-17 11:22:42 -04:00
parent 992cc96da6
commit fd462e9d5e
3 changed files with 12 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
TimberWinR/Inputs/InputListener.cs
View File

@@ -11,14 +11,10 @@ namespace TimberWinR.Inputs
public CancellationToken CancelToken { get; set; }
public event Action<string> OnMessageRecieved;
public FieldDefinitions Fields { get; set; }
public ParameterDefinitions Parameters { get; set; }
public InputListener(CancellationToken token, FieldDefinitions fields, ParameterDefinitions parms)
public InputListener(CancellationToken token)
{
this.CancelToken = token;
Parameters = parms;
Fields = fields;
this.CancelToken = token;
}
protected void ProcessJson(string message)

2
TimberWinR/Inputs/TcpInputListener.cs
View File

@@ -15,7 +15,7 @@ namespace TimberWinR.Inputs
private Thread _listenThread;
const int bufferSize = 16535;
public TcpInputListener(CancellationToken cancelToken, int port = 5140) : base(cancelToken, null, null)
public TcpInputListener(CancellationToken cancelToken, int port = 5140) : base(cancelToken)
{
_tcpListener = new System.Net.Sockets.TcpListener(IPAddress.Any, port);
_listenThread = new Thread(new ThreadStart(ListenForClients));

36
TimberWinR/Inputs/WindowsEvtInputListener.cs
View File

@@ -26,7 +26,7 @@ namespace TimberWinR.Inputs
private TimberWinR.Configuration.WindowsEvents _arguments;
public WindowsEvtInputListener(TimberWinR.Configuration.WindowsEvents arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 1)
: base(cancelToken, FieldDefinitions, ParameterDefinitions)
: base(cancelToken)
{
_arguments = arguments;
_pollingIntervalInSeconds = pollingIntervalInSeconds;
@@ -39,8 +39,7 @@ namespace TimberWinR.Inputs
var oLogQuery = new LogQuery();
var fileName = Path.Combine(System.IO.Path.GetTempPath(),
string.Format("{0}.lpc", Guid.NewGuid().ToString()));
string.Format("{0}.lpc", Guid.NewGuid().ToString()));
// Instantiate the Event Log Input Format object
var iFmt = new EventLogInputFormat()
@@ -69,14 +68,14 @@ namespace TimberWinR.Inputs
{
var record = rs.getRecord();
var json = new JObject();
foreach (var field in Fields)
foreach (var fieldName in _arguments.Fields)
{
object v = record.getValue(field.Name);
object v = record.getValue(fieldName);
if (field.FieldType == typeof(DateTime))
v = field.ToDateTime(v).ToUniversalTime();
// if (field.FieldType == typeof(DateTime))
// v = field.ToDateTime(v).ToUniversalTime();
json.Add(new JProperty(field.Name, v));
json.Add(new JProperty(fieldName, v));
}
json.Add(new JProperty("type", "Win32-Eventlog"));
ProcessJson(json.ToString());
@@ -92,26 +91,7 @@ namespace TimberWinR.Inputs
firstQuery = false;
System.Threading.Thread.Sleep(_pollingIntervalInSeconds * 1000);
}
}
public static ParameterDefinitions ParameterDefinitions
{
get
{
return new ParameterDefinitions()
{
{"fullText", "ON", typeof(bool), new string[] {"OFF", "ON"}},
{"resolveSIDs", "OFF", typeof(bool), new string[] {"OFF", "ON"}},
{"formatMsg", "ON", typeof(bool), new string[] {"OFF", "ON"}},
{"msgErrorMode", "MSG", typeof(string), new string[] {"NULL", "ERROR", "MSG"}},
{"fullEventCode", "OFF", typeof(bool), new string[] {"OFF", "ON"}},
{"direction", "FW", typeof(string), new string[] {"FW", "BW"}},
{"stringsSep", "|", typeof(string)},
{"binaryFormat", "HEX", typeof(string), new string[] {"ASC", "PRINT", "HEX"}},
};
}
}
}
public static FieldDefinitions FieldDefinitions
{