diff --git a/lib/fluent/plugin/in_windows_eventlog2.rb b/lib/fluent/plugin/in_windows_eventlog2.rb index 038511a..5d6c1a6 100644 --- a/lib/fluent/plugin/in_windows_eventlog2.rb +++ b/lib/fluent/plugin/in_windows_eventlog2.rb @@ -1,10 +1,16 @@ require 'winevt' require 'fluent/plugin/input' require 'fluent/plugin' -require_relative 'bookmark_sax_parser' module Fluent::Plugin class WindowsEventLog2Input < Input + begin + require_relative 'bookmark_sax_parser' + @@bookmark_parser_avaiable = true + rescue LoadError + @@bookmark_parser_avaiable = false + end + Fluent::Plugin.register_input('windows_eventlog2', self) class ReconnectError < Fluent::UnrecoverableError; end @@ -227,11 +233,16 @@ def clear_subscritpions end def subscription(ch, read_existing_events, remote_session) - bookmarkXml = @bookmarks_storage.get(ch) || "" bookmark = nil - if bookmark_validator(bookmarkXml, ch) - bookmark = Winevt::EventLog::Bookmark.new(bookmarkXml) + bookmarkXml = @bookmarks_storage.get(ch) || "" + unless bookmarkXml.empty? + if bookmark_valid?(bookmarkXml, ch) + bookmark = Winevt::EventLog::Bookmark.new(bookmarkXml) + else + log.warn "This stored bookmark is incomplete for using. Referring `read_existing_events` parameter to subscribe: #{bookmarkXml}, channel: #{ch}" + end end + subscribe = Winevt::EventLog::Subscribe.new subscribe.read_existing_events = read_existing_events begin @@ -258,19 +269,26 @@ def subscribe_channels(subscriptions) end end - def bookmark_validator(bookmarkXml, channel) - return false if bookmarkXml.empty? + def bookmark_valid?(bookmarkXml, channel) + if @@bookmark_parser_avaiable + bookmark_valid_strictly?(bookmarkXml, channel) + else + bookmarklist_is_not_empty?(bookmarkXml, channel) + end + end + def bookmark_valid_strictly?(bookmarkXml, channel) evtxml = WinevtBookmarkDocument.new parser = Nokogiri::XML::SAX::Parser.new(evtxml) parser.parse(bookmarkXml) result = evtxml.result - if !result.empty? && (result[:channel].downcase == channel.downcase) && result[:is_current] - true - else - log.warn "This stored bookmark is incomplete for using. Referring `read_existing_events` parameter to subscribe: #{bookmarkXml}, channel: #{channel}" - false - end + !result.empty? && (result[:channel].downcase == channel.downcase) && result[:is_current] + end + + def bookmarklist_is_not_empty?(bookmarkXml, channel) + # Empty example: "\r\n" + # Not empty example: "\r\n \r\n" + bookmarkXml.include?("Channel") end def escape_channel(ch)