phrocker commented on a change in pull request #648: WIP: Minificpp 1025 -- add
metadata
URL: https://github.com/apache/nifi-minifi-cpp/pull/648#discussion_r325779826
##########
File path: extensions/windows-event-log/ConsumeWindowsEventLog.cpp
##########
@@ -209,57 +216,71 @@ bool ConsumeWindowsEventLog::subscribe(const
std::shared_ptr<core::ProcessContex
subscriptionHandle_ = EvtSubscribe(
NULL,
NULL,
- std::wstring(channel.begin(), channel.end()).c_str(),
+ std::wstring(channel_.begin(), channel_.end()).c_str(),
std::wstring(query.begin(), query.end()).c_str(),
NULL,
this,
- [](EVT_SUBSCRIBE_NOTIFY_ACTION action, PVOID pContext, EVT_HANDLE hEvent)
+ [](EVT_SUBSCRIBE_NOTIFY_ACTION action, PVOID pContext, EVT_HANDLE
eventHandle)
{
+
auto pConsumeWindowsEventLog =
static_cast<ConsumeWindowsEventLog*>(pContext);
auto& logger = pConsumeWindowsEventLog->logger_;
if (action == EvtSubscribeActionError) {
- if (ERROR_EVT_QUERY_RESULT_STALE == (DWORD)hEvent) {
+ if (ERROR_EVT_QUERY_RESULT_STALE == (DWORD)eventHandle) {
logger->log_error("Received missing event notification. Consider
triggering processor more frequently or increasing queue size.");
} else {
- logger->log_error("Received the following Win32 error: %x",
hEvent);
+ logger->log_error("Received the following Win32 error: %x",
eventHandle);
}
} else if (action == EvtSubscribeActionDeliver) {
DWORD size = 0;
DWORD used = 0;
DWORD propertyCount = 0;
-
- if (!EvtRender(NULL, hEvent, EvtRenderEventXml, size, 0, &used,
&propertyCount)) {
+ if (!EvtRender(NULL, eventHandle, EvtRenderEventXml, size, 0, &used,
&propertyCount)) {
if (ERROR_INSUFFICIENT_BUFFER == GetLastError()) {
if (used > pConsumeWindowsEventLog->maxBufferSize_) {
- logger->log_error("Dropping event %x because it couldn't be
rendered within %ll bytes.", hEvent, pConsumeWindowsEventLog->maxBufferSize_);
+ logger->log_error("Dropping event %x because it couldn't be
rendered within %ll bytes.", eventHandle,
pConsumeWindowsEventLog->maxBufferSize_);
return 0UL;
}
size = used;
std::vector<wchar_t> buf(size/2 + 1);
- if (EvtRender(NULL, hEvent, EvtRenderEventXml, size, &buf[0],
&used, &propertyCount)) {
+ if (EvtRender(NULL, eventHandle, EvtRenderEventXml, size,
&buf[0], &used, &propertyCount)) {
std::string xml = to_string(&buf[0]);
EventRender renderedData;
pugi::xml_document doc;
pugi::xml_parse_result result =
doc.load_string(xml.c_str());
-
-
if (!result) {
- logger->log_error("'loadXML' failed");
+ logger->log_error("Invalid XML
produced");
return 0UL;
}
+ // this is a well known path.
+ std::string providerName =
doc.child("Event").child("System").child("Provider").attribute("Name").value();
+
+ auto handler =
pConsumeWindowsEventLog->getEventLogHandler(providerName);
+ auto message =
handler.getEventMessage(eventHandle);
+
- std::string providerName =
doc.child("System").child("Provider").attribute("Name").value();
// resolve the event metadata
- wel::MetadataWalker
walker(pConsumeWindowsEventLog->getProvider(providerName), hEvent,
!pConsumeWindowsEventLog->resolve_as_attributes_,
pConsumeWindowsEventLog->apply_identifier_function_,
pConsumeWindowsEventLog->regex_);
+ wel::MetadataWalker
walker(pConsumeWindowsEventLog->getEventLogHandler(providerName).getMetadata(),
eventHandle, !pConsumeWindowsEventLog->resolve_as_attributes_,
pConsumeWindowsEventLog->apply_identifier_function_,
pConsumeWindowsEventLog->regex_);
doc.traverse(walker);
+
+ if (!message.empty())
Review comment:
will apply the linter before making this PR official.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
