Skip to content

Commit 57f4891

Browse files
safchainarbll
safchain
authored and
arbll
committed
[CWS] improve windows logs (#35093)
1 parent 3901163 commit 57f4891

File tree

3 files changed

+106
-69
lines changed

3 files changed

+106
-69
lines changed

‎pkg/security/probe/probe_kernel_file_windows.go‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -221,10 +221,10 @@ func (wp *WindowsProbe) parseCreateNewFileArgs(e *etw.DDEventRecord) (*createNew
221221
func (ca *createHandleArgs) string(t string) string {
222222
var output strings.Builder
223223

224-
output.WriteString(t + " PID: " + strconv.Itoa(int(ca.ProcessID)) + "\n")
225-
output.WriteString(" Name: " + ca.fileName + "\n")
226-
output.WriteString(" Opts: " + strconv.FormatUint(uint64(ca.createOptions), 16) + " Share: " + strconv.FormatUint(uint64(ca.shareAccess), 16) + "\n")
227-
output.WriteString(" OBJ: " + strconv.FormatUint(uint64(ca.fileObject), 16) + "\n")
224+
output.WriteString(t + " PID: " + strconv.Itoa(int(ca.ProcessID)) + ", ")
225+
output.WriteString("Name: " + ca.fileName + ", ")
226+
output.WriteString("Opts: " + strconv.FormatUint(uint64(ca.createOptions), 16) + " Share: " + strconv.FormatUint(uint64(ca.shareAccess), 16) + ",")
227+
output.WriteString("Obj: " + strconv.FormatUint(uint64(ca.fileObject), 16))
228228

229229
return output.String()
230230
}
@@ -316,11 +316,11 @@ func (wp *WindowsProbe) parseInformationArgs(e *etw.DDEventRecord) (*setInformat
316316
func (sia *setInformationArgs) string(t string) string {
317317
var output strings.Builder
318318

319-
output.WriteString(t + " TID: " + strconv.Itoa(int(sia.threadID)) + "\n")
320-
output.WriteString(" Name: " + sia.fileName + "\n")
321-
output.WriteString(" InfoClass: " + strconv.FormatUint(uint64(sia.infoClass), 16) + "\n")
322-
output.WriteString(" OBJ: " + strconv.FormatUint(uint64(sia.fileObject), 16) + "\n")
323-
output.WriteString(" KEY: " + strconv.FormatUint(uint64(sia.fileKey), 16) + "\n")
319+
output.WriteString(t + " TID: " + strconv.Itoa(int(sia.threadID)) + ", ")
320+
output.WriteString("Name: " + sia.fileName + ", ")
321+
output.WriteString("InfoClass: " + strconv.FormatUint(uint64(sia.infoClass), 16) + ", ")
322+
output.WriteString("Obj: " + strconv.FormatUint(uint64(sia.fileObject), 16) + ", ")
323+
output.WriteString("Key: " + strconv.FormatUint(uint64(sia.fileKey), 16))
324324

325325
return output.String()
326326

@@ -473,10 +473,10 @@ func (wp *WindowsProbe) parseFlushArgs(e *etw.DDEventRecord) (*flushArgs, error)
473473
func (ca *cleanupArgs) string(t string) string {
474474
var output strings.Builder
475475

476-
output.WriteString(t + ": TID: " + strconv.Itoa(int(ca.threadID)) + "\n")
477-
output.WriteString(" Name: " + ca.fileName + "\n")
478-
output.WriteString(" OBJ: " + strconv.FormatUint(uint64(ca.fileObject), 16) + "\n")
479-
output.WriteString(" KEY: " + strconv.FormatUint(uint64(ca.fileKey), 16) + "\n")
476+
output.WriteString(t + ": TID: " + strconv.Itoa(int(ca.threadID)) + ", ")
477+
output.WriteString("Name: " + ca.fileName + ", ")
478+
output.WriteString("Obj: " + strconv.FormatUint(uint64(ca.fileObject), 16) + ", ")
479+
output.WriteString("Key: " + strconv.FormatUint(uint64(ca.fileKey), 16))
480480
return output.String()
481481

482482
}
@@ -511,7 +511,7 @@ type readArgs struct {
511511
}
512512
type writeArgs readArgs
513513

514-
func (wp *WindowsProbe) parseReadArgs(e *etw.DDEventRecord) (*readArgs, error) {
514+
func (wp *WindowsProbe) parseReadWriteArgs(e *etw.DDEventRecord) (*readArgs, error) {
515515
ra := &readArgs{
516516
DDEventHeader: e.EventHeader,
517517
}
@@ -554,11 +554,11 @@ func (wp *WindowsProbe) parseReadArgs(e *etw.DDEventRecord) (*readArgs, error) {
554554
func (ra *readArgs) string(t string) string {
555555
var output strings.Builder
556556

557-
output.WriteString(t + ": PID: " + strconv.Itoa(int(ra.DDEventHeader.ProcessID)) + "\n")
558-
output.WriteString(" fo: " + strconv.FormatUint(uint64(ra.fileObject), 16) + "\n")
559-
output.WriteString(" fk: " + strconv.FormatUint(uint64(ra.fileKey), 16) + "\n")
560-
output.WriteString(" Name: " + ra.fileName + "\n")
561-
output.WriteString(" Size: " + strconv.FormatUint(uint64(ra.IOSize), 16) + "\n")
557+
output.WriteString(t + ": PID: " + strconv.Itoa(int(ra.DDEventHeader.ProcessID)) + ", ")
558+
output.WriteString("Obj: " + strconv.FormatUint(uint64(ra.fileObject), 16) + ", ")
559+
output.WriteString("Key: " + strconv.FormatUint(uint64(ra.fileKey), 16) + ", ")
560+
output.WriteString("Name: " + ra.fileName + ", ")
561+
output.WriteString("Size: " + strconv.FormatUint(uint64(ra.IOSize), 16))
562562
return output.String()
563563

564564
}
@@ -569,7 +569,7 @@ func (ra *readArgs) String() string {
569569
}
570570

571571
func (wp *WindowsProbe) parseWriteArgs(e *etw.DDEventRecord) (*writeArgs, error) {
572-
wa, err := wp.parseReadArgs(e)
572+
wa, err := wp.parseReadWriteArgs(e)
573573
if err != nil {
574574
return nil, err
575575
}
@@ -660,10 +660,10 @@ func (wp *WindowsProbe) parseDeletePathArgs(e *etw.DDEventRecord) (*deletePathAr
660660
func (dpa *deletePathArgs) string(t string) string {
661661
var output strings.Builder
662662

663-
output.WriteString(t + ": PID: " + strconv.Itoa(int(dpa.ProcessID)) + "\n")
664-
output.WriteString(" Name: " + dpa.filePath + "\n")
665-
output.WriteString(" OBJ: " + strconv.FormatUint(uint64(dpa.fileObject), 16) + "\n")
666-
output.WriteString(" KEY: " + strconv.FormatUint(uint64(dpa.fileKey), 16) + "\n")
663+
output.WriteString(t + ": PID: " + strconv.Itoa(int(dpa.ProcessID)) + ", ")
664+
output.WriteString("Name: " + dpa.filePath + ", ")
665+
output.WriteString("Obj: " + strconv.FormatUint(uint64(dpa.fileObject), 16) + ", ")
666+
output.WriteString("Key: " + strconv.FormatUint(uint64(dpa.fileKey), 16))
667667
return output.String()
668668

669669
}
@@ -733,8 +733,8 @@ func (wp *WindowsProbe) parseNameCreateArgs(e *etw.DDEventRecord) (*nameCreateAr
733733
func (ca *nameCreateArgs) string(t string) string {
734734
var output strings.Builder
735735

736-
output.WriteString(t + ": KEY: " + strconv.FormatUint(uint64(ca.fileKey), 16) + "\n")
737-
output.WriteString(" Name: " + ca.fileName + "\n")
736+
output.WriteString(t + ": Key: " + strconv.FormatUint(uint64(ca.fileKey), 16) + ", ")
737+
output.WriteString("Name: " + ca.fileName)
738738
return output.String()
739739

740740
}

‎pkg/security/probe/probe_kernel_reg_windows.go‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -197,13 +197,13 @@ func (cka *createKeyArgs) String() string {
197197

198198
var output strings.Builder
199199

200-
output.WriteString(" PID: " + strconv.Itoa(int(cka.ProcessID)) + "\n")
201-
output.WriteString(" Status: " + strconv.Itoa(int(cka.status)) + " Disposition: " + strconv.Itoa(int(cka.disposition)) + "\n")
202-
output.WriteString(" baseObject: " + strconv.FormatUint(uint64(cka.baseObject), 16) + "\n")
203-
output.WriteString(" keyObject: " + strconv.FormatUint(uint64(cka.keyObject), 16) + "\n")
204-
output.WriteString(" basename: " + cka.baseName + "\n")
205-
output.WriteString(" relativename: " + cka.relativeName + "\n")
206-
output.WriteString(" computedfullpath: " + cka.computedFullPath + "\n")
200+
output.WriteString("PID: " + strconv.Itoa(int(cka.ProcessID)) + ", ")
201+
output.WriteString("Status: " + strconv.Itoa(int(cka.status)) + " Disposition: " + strconv.Itoa(int(cka.disposition)) + ", ")
202+
output.WriteString("BaseObject: " + strconv.FormatUint(uint64(cka.baseObject), 16) + ", ")
203+
output.WriteString("KeyObject: " + strconv.FormatUint(uint64(cka.keyObject), 16) + ", ")
204+
output.WriteString("Basename: " + cka.baseName + ", ")
205+
output.WriteString("Relativename: " + cka.relativeName + ", ")
206+
output.WriteString("Computedfullpath: " + cka.computedFullPath)
207207
return output.String()
208208
}
209209

@@ -262,10 +262,10 @@ func (wp *WindowsProbe) parseSetSecurityKeyArgs(e *etw.DDEventRecord) (*setSecur
262262
func (dka *deleteKeyArgs) String() string {
263263
var output strings.Builder
264264

265-
output.WriteString(" PID: " + strconv.Itoa(int(dka.ProcessID)) + "\n")
266-
output.WriteString(" Status: " + strconv.Itoa(int(dka.status)) + "\n")
267-
output.WriteString(" keyName: " + dka.keyName + "\n")
268-
output.WriteString(" resolved path: " + dka.computedFullPath + "\n")
265+
output.WriteString("PID: " + strconv.Itoa(int(dka.ProcessID)) + ", ")
266+
output.WriteString("Status: " + strconv.Itoa(int(dka.status)) + ", ")
267+
output.WriteString("KeyName: " + dka.keyName + "\n")
268+
output.WriteString("Resolved path: " + dka.computedFullPath)
269269

270270
//output.WriteString(" CapturedSize: " + strconv.Itoa(int(sv.capturedPreviousDataSize)) + " pvssize: " + strconv.Itoa(int(sv.previousDataSize)) + " capturedpvssize " + strconv.Itoa(int(sv.capturedPreviousDataSize)) + "\n")
271271
return output.String()
@@ -351,12 +351,12 @@ func (wp *WindowsProbe) parseSetValueKey(e *etw.DDEventRecord) (*setValueKeyArgs
351351
func (sv *setValueKeyArgs) String() string {
352352
var output strings.Builder
353353

354-
output.WriteString(" PID: " + strconv.Itoa(int(sv.ProcessID)) + "\n")
355-
output.WriteString(" Status: " + strconv.Itoa(int(sv.status)) + " dataType: " + strconv.Itoa(int(sv.dataType)) + " dataSize " + strconv.Itoa(int(sv.dataSize)) + "\n")
356-
output.WriteString(" keyObject: " + strconv.FormatUint(uint64(sv.keyObject), 16) + "\n")
357-
output.WriteString(" keyName: " + sv.keyName + "\n")
358-
output.WriteString(" valueName: " + sv.valueName + "\n")
359-
output.WriteString(" computed path: " + sv.computedFullPath + "\n")
354+
output.WriteString("PID: " + strconv.Itoa(int(sv.ProcessID)) + ", ")
355+
output.WriteString("Status: " + strconv.Itoa(int(sv.status)) + " dataType: " + strconv.Itoa(int(sv.dataType)) + " dataSize " + strconv.Itoa(int(sv.dataSize)) + ", ")
356+
output.WriteString("KeyObject: " + strconv.FormatUint(uint64(sv.keyObject), 16) + ", ")
357+
output.WriteString("KeyName: " + sv.keyName + ", ")
358+
output.WriteString("CalueName: " + sv.valueName + ", ")
359+
output.WriteString("Computed path: " + sv.computedFullPath)
360360

361361
//output.WriteString(" CapturedSize: " + strconv.Itoa(int(sv.capturedPreviousDataSize)) + " pvssize: " + strconv.Itoa(int(sv.previousDataSize)) + " capturedpvssize " + strconv.Itoa(int(sv.capturedPreviousDataSize)) + "\n")
362362
return output.String()

0 commit comments

Comments
 (0)