Fix MSSQL log parser bug

dissect/target/plugins/os/windows/log/mssql.py

@@ -78,22 +78,57 @@ def errorlog(self) -> Iterator[MssqlErrorlogRecord]:
             for errorlog in log_path.glob(self.FILE_GLOB):
                 # The errorlog includes a BOM, so endianess gets determined automatically
                 fh = errorlog.open(mode="rt", encoding="utf-16", errors="surrogateescape")
+                first = fh.readline()
+
+                # MSSQL ERRORLOG files should always start with a timestamp.
+                if RE_TIMESTAMP_PATTERN.match(first):
+                    pass
+                else:
+                    self.target.log.error(
+                        "Logfile %s does not start with a timestamp. Skipping.",
+                        errorlog,
+                    )
+                    continue
+
+                fh.seek(0)
                 buf = ""
 
                 for line in fh:
-                    if ts := RE_TIMESTAMP_PATTERN.match(line):
+                    # If we have a buffer with a timestamp and
+                    # our current line also has a timestamp,
+                    # we should have a complete record in our buffer.
+                    if previous_ts := RE_TIMESTAMP_PATTERN.match(buf):
+                        if current_ts := RE_TIMESTAMP_PATTERN.match(line):
+                            yield MssqlErrorlogRecord(
+                                ts=datetime.strptime(previous_ts.group(), "%Y-%m-%d %H:%M:%S.%f").replace(
+                                    tzinfo=timezone.utc
+                                ),
+                                instance=instance,
+                                # The process name is a fixed-width field and is always 12 characters long.
+                                process=buf[23:35].strip(),
+                                message=buf[35:].strip(),
+                                path=errorlog,
+                                _target=self.target,
+                            )
+
+                            buf = ""
+
+                    buf += line
+
+                # For the last line
+                if buf:
+                    if current_ts := RE_TIMESTAMP_PATTERN.match(buf):
                         yield MssqlErrorlogRecord(
-                            ts=datetime.strptime(ts.group(), "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
+                            ts=datetime.strptime(current_ts.group(), "%Y-%m-%d %H:%M:%S.%f").replace(
+                                tzinfo=timezone.utc
+                            ),
                             instance=instance,
                             # The process name is a fixed-width field and is always 12 characters long.
                             process=buf[23:35].strip(),
                             message=buf[35:].strip(),
                             path=errorlog,
                             _target=self.target,
                         )
-                        buf = ""
-
-                    buf += line
 
     def _find_instances(self) -> set[str, TargetPath]:
         return {

tests/plugins/os/windows/log/test_mssql.py

@@ -40,3 +40,19 @@ def test_mssql_errorlog(target_win_users: Target, hive_hklm: VirtualHive, fs_win
     assert record.process == "Server"
     assert record.message.startswith("The SQL Server Network Interface library could not register")
     assert record.path == "C:\\Temp\\MSSQL\\Log\\ERRORLOG"
+
+    first_record = records[0]
+    assert str(first_record.ts) == "2024-04-08 12:16:38.560000+00:00"
+    assert first_record.instance == "MSSQL69.MyInstance"
+    assert first_record.process == "Server"
+    assert "\n" in first_record.message
+    assert "\t" in first_record.message
+    assert first_record.message.endswith("(Hypervisor)")
+
+    last_record = records[-1]
+    assert str(last_record.ts) == "2024-08-01 21:34:44.450000+00:00"
+    assert last_record.instance == "MSSQL69.MyInstance"
+    assert last_record.process == "spid6s"
+    assert "\n" in last_record.message
+    assert "\t" in last_record.message
+    assert last_record.message.endswith("no user action is required.")