Skip to content

in_winevtlog: Make configurable for the size of collecting threshold per a cycle #8677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edsiper merged 8 commits into from
Apr 11, 2024
Merged

in_winevtlog: Make configurable for the size of collecting threshold per a cycle #8677

Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f6a4d46
in_winevtlog: Make configurable for the size of collecting threshold …
cosmo0920 Apr 5, 2024
83a247c
in_winevtlog: Address comments
cosmo0920 Apr 9, 2024
540faf2
in_winevtlog: Handle read_limit_per_cycle parameter as size type on c…
cosmo0920 Apr 10, 2024
e52c40f
in_winevtlog: Handle the default value of read_limit_per_cycle parameter
cosmo0920 Apr 10, 2024
35ee9a2
in_winevtlog: Display the specified values for the collecting size of…
cosmo0920 Apr 10, 2024
ced8b0b
in_winevtlog: Specify the maximum cutoff value thorough the current s…
cosmo0920 Apr 11, 2024
a5caba4
in_winevtlog: Display the upper limit with the calculated value
cosmo0920 Apr 11, 2024
cf0c5bf
in_winevtlog: Downgrade for the log level for lower threshold
cosmo0920 Apr 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions plugins/in_winevtlog/in_winevtlog.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@
#define DEFAULT_INTERVAL_SEC 1
#define DEFAULT_INTERVAL_NSEC 0
#define DEFAULT_THRESHOLD_SIZE 0x7ffff /* Default reading buffer size (512kb) */
#define MINIMUM_THRESHOLD_SIZE 0x0400 /* 1024 bytes */
#define MAXIMUM_THRESHOLD_SIZE 0x1ccccd /* 1887437 bytes (about 1.8 MiB) */

@leonardo-albertovich leonardo-albertovich Apr 10, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Set MAXIMUM_THRESHOLD_SIZE to (FLB_INPUT_CHUNK_FS_MAX_SIZE - (1024 * 200)) so it scales in case someone changes the default maximum chunk size.

I guess in the future when we make the chunk size configurable we'll have to do that in runtime.

@leonardo-albertovich leonardo-albertovich Apr 10, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry about not requesting it this way the first time around, it must've slipped from my mind.

@cosmo0920 cosmo0920 Apr 11, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No worries. Your suggestion is also helpful. And it has more effective than just specified the fixed value for the current adequate value.


static int in_winevtlog_collect(struct flb_input_instance *ins,
struct flb_config *config, void *in_context);
Expand All @@ -37,6 +39,7 @@ static int in_winevtlog_init(struct flb_input_instance *in,
struct flb_config *config, void *data)
{
int ret;
int64_t threshold_size;
const char *tmp;
int read_existing_events = FLB_FALSE;
struct mk_list *head;
Expand Down Expand Up @@ -70,6 +73,23 @@ static int in_winevtlog_init(struct flb_input_instance *in,

/* Set up total reading size threshold */
ctx->total_size_threshold = DEFAULT_THRESHOLD_SIZE;
tmp = flb_input_get_property("read_limit_per_cycle", in);
if (tmp != NULL) {
threshold_size = flb_utils_size_to_bytes(tmp);
if (threshold_size >= MINIMUM_THRESHOLD_SIZE &&
threshold_size < MAXIMUM_THRESHOLD_SIZE) {
ctx->total_size_threshold = (unsigned int) threshold_size;
flb_plg_debug(ctx->ins,
"read limit per cycle is changed to %" PRId64 "KB",
threshold_size / 1000);
}
else if (threshold_size >= MAXIMUM_THRESHOLD_SIZE) {
flb_plg_warn(ctx->ins,
"read limit per cycle cannot exceed 1.8MiB. Set up to %d",
MAXIMUM_THRESHOLD_SIZE);
ctx->total_size_threshold = (unsigned int) MAXIMUM_THRESHOLD_SIZE;
}
}

/* Open channels */
tmp = flb_input_get_property("channels", in);
Expand Down Expand Up @@ -261,6 +281,11 @@ static struct flb_config_map config_map[] = {
0, FLB_TRUE, offsetof(struct winevtlog_config, event_query),
"Specify XML query for filtering events"
},
{
FLB_CONFIG_MAP_STR, "read_limit_per_cycle", NULL,
Comment thread
cosmo0920 marked this conversation as resolved.
Outdated
0, FLB_TRUE, 0,
"Specify reading limit for collecting Windows EventLog per a cycle"
},
/* EOF */
{0}
};
Expand Down