mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
Issahar G
f4aa34ff7e
* add native support for event filters via API * not finished: created one unittest to show usage of native filtering... * adjust memory usage out of scope.... * file delete event in tests.... * resolving issue 1 in comments of pull request * issue 2 in pull request comments * comment 3 in pull request: indentation * issue 4: identation of if * excessive comment * fixed typedef * removing hungarian convention * camelCase to snake_case * snake_case * fixing more comments in pull request * uncommenting the first test * applying comments of pull request * supporting native event filtering alternated with predicates on other settings * fix identation * fixing style * fixing tabs to spaces * fix identation * basing on last change requests except the different method for filterDesc composition which is reasked by me if we could ignore or not. * fix to reference * undo excessive change in styling. The file whole written in other style * fixing indentation of for loop
59 lines
2.5 KiB
C++
59 lines
2.5 KiB
C++
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
// Krabs supports provider filtering based on ETW API filtering features.
|
|
// This example listening for file delete event together with predicate which we post
|
|
// process event id filter with other filtering
|
|
//
|
|
|
|
#include <iostream>
|
|
#include <cassert>
|
|
|
|
#include "..\..\krabs\krabs.hpp"
|
|
#include "examples.h"
|
|
|
|
void user_trace_004::start()
|
|
{
|
|
// user_trace instances should be used for any non-kernel traces that are defined
|
|
// by components or programs in Windows. They can optionally take a name -- if none
|
|
// is provided, a random GUID is assigned as the name.
|
|
krabs::user_trace trace(L"My Named Trace");
|
|
|
|
// A trace can have any number of providers, which are identified by GUID. These
|
|
// GUIDs are defined by the components that emit events, and their GUIDs can
|
|
// usually be found with various ETW tools (like wevutil).
|
|
|
|
//listen for file events
|
|
krabs::provider<> provider(krabs::guid(L"{EDD08927-9CC4-4E65-B970-C2560FB5C289}"));
|
|
|
|
// In user_trace_001.cpp we manually filter events by checking the event information
|
|
// In user_trace_002.cpp we filter events using provider predicates
|
|
// In user_trace_003_no_predicates.cpp we filter with ETW filtering only without predicate
|
|
// In this example (user_trace_004), we're going to use both provider filter based on ETW filtering features
|
|
// and predicate which does additional filtering
|
|
|
|
// We instantiate an event_filter first. An event_filter is created with a
|
|
// event id which will be forwarded as filter to etw tracing api
|
|
// predicate filtering is taking in consideration only system process
|
|
krabs::event_filter filter(11, krabs::predicates::process_id_is(4));
|
|
|
|
auto cb = [](const EVENT_RECORD &record) {
|
|
krabs::schema schema(record);
|
|
assert(schema.event_id() == 11);
|
|
assert(schema.process_id() == 4);
|
|
std::wcout << L"Event " +
|
|
std::to_wstring(schema.event_id()) +
|
|
L" received for pid " +
|
|
std::to_wstring(schema.process_id()) << std::endl;
|
|
};
|
|
|
|
filter.add_on_event_callback(cb);
|
|
|
|
// event_filters are attached to providers. Events that are attached to a filter will
|
|
// only be called when the filter allows the event through. Any events attached to the
|
|
// provider directly will be called for all events that are fired by the ETW producer.
|
|
provider.add_filter(filter);
|
|
trace.enable(provider);
|
|
trace.start();
|
|
}
|