Feature Request: Subscribe to all log channels about fluent-plugin-windows-eventlog HOT 5 CLOSED

Hmm.., we can implement this feature request with https://rdoc.info/gems/winevt_c/0.7.0/Winevt%2FEventLog%2FChannel:each.

from fluent-plugin-windows-eventlog.

Hmm.., we can implement this feature request with https://rdoc.info/gems/winevt_c/0.7.0/Winevt%2FEventLog%2FChannel:each.

Oh did not know that one worked like that. Seemse to be really easy to implement this. If you are not already on it I can try to get it done tomorrow.

from fluent-plugin-windows-eventlog.

Do you know if there is a max amount of channel it can subscribe to? Feels like this picks up way to many channels which gives me error 50:

2020-02-26 10:57:54 +0100 [error]: #0 config error file="etc/td-agent/td-agent.conf" error_class=Fluent::ConfigError error="Invalid Bookmark XML is loaded. ErrorCode: 50\nError: Beg\u00E4ran st\u00F6ds inte.\r\n\n"

It picked up over 1000 channels

EDIT: Seemse like its some of the channels that isnt avaible to subscribe to. Comparing this to my powershell script it feels like all these channels doesnt even exist in the event viewer program. I get about 150 channels from powershell.

EDIT 2: Did a rescue around the subscribe_channel(ch, read_existing_events) so I could get all the working channels, and there were 440 working channels, out of 1100... In theory this would work fine, doesnt take to long and would only do this if we have like "read_all_channels = true", because then all the channels that doesnt work shouldnt be there anyway

List of all the non-working channels

from fluent-plugin-windows-eventlog.

Do you know if there is a max amount of channel it can subscribe to? Feels like this picks up way to many channels which gives me error 50:

2020-02-26 10:57:54 +0100 [error]: #0 config error file="etc/td-agent/td-agent.conf" error_class=Fluent::ConfigError error="Invalid Bookmark XML is loaded. ErrorCode: 50\nError: Beg\u00E4ran st\u00F6ds inte.\r\n\n"

This should be Debug or Analytical EventLog channel case, I guess:
https://github.com/PowerShell/PowerShell/blob/master/src/Microsoft.PowerShell.Commands.Diagnostics/GetEventCommand.cs#L627-L633

This skipping feature for Debug or Analytical cases is not implemented in winevt_c.
We should implement it first instead of just using Pokemon exception handling.

from fluent-plugin-windows-eventlog.

#48 is merged. Closing.

from fluent-plugin-windows-eventlog.