Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[receiver/windowseventlog] Add suppress_rendering_info parameter and simplify internal logic. #34720

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

djaglowski
Copy link
Member

@djaglowski djaglowski commented Aug 16, 2024

Description:

This PR contains several changes described in #34131. It does not go as far as breaking out a separate parsing component, but I think it is enough to satisfy the known use cases.

I will likely break out some smaller PRs, but currently this includes:

  • Add suppress_rendering_info parameter, which acts orthogonally to raw flag.
  • Use a single EventXML struct for all configurations. Remove a lot of related duplication.
  • Decouple interpretation methods from EventXML so they can be more easily reused.
  • Remove RemoteServer field from EventXML. Instead, set attributes["remote_server"] if remote collection is used.
    • TODO: Reconsider whether the attribute is ever needed, since EventXML.Computer may satisfy the use case. If the attribute is needed, find a better name for it.

Link to tracking Issue:

Resolves #34131

Copy link
Contributor

@pjanotti pjanotti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks to be going in the right direction.

pkg/stanza/operator/input/windows/event.go Outdated Show resolved Hide resolved
pkg/stanza/operator/input/windows/event.go Outdated Show resolved Hide resolved
pkg/stanza/operator/input/windows/event.go Show resolved Hide resolved
pkg/stanza/operator/input/windows/input.go Outdated Show resolved Hide resolved
pkg/stanza/operator/input/windows/input.go Outdated Show resolved Hide resolved
pkg/stanza/operator/input/windows/xml.go Outdated Show resolved Hide resolved
i.Logger().Error("Failed to create entry", zap.Error(err))
return
if i.remote.Server != "" {
e.Attributes["remote_server"] = i.remote.Server
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the server.address attribute may be appropriate here. Any opinions on this?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems reasonable to me.

@pjanotti
Copy link
Contributor

pjanotti commented Sep 4, 2024

@djaglowski ping me when you think this one is ready (or if you want another pass while still a draft)

@djaglowski
Copy link
Member Author

djaglowski commented Sep 4, 2024

Thanks @pjanotti, I'm still just trying to get it to pass CI. There have been a bunch of unrelated tests failing but now it's just https://github.com/open-telemetry/opentelemetry-collector-contrib/actions/runs/10706954934/job/29685874116?pr=34720#step:6:556, which may or may not be related. I don't know if you have any insight on that one but if you do it would be very helpful.

@pjanotti
Copy link
Contributor

pjanotti commented Sep 5, 2024

@djaglowski there is something really going on with these tests, when I submitted the PR with the overall changes to the tests I wasn't getting any failure on my machine, but, now it seems almost constant. Nothing conclusive yet but will be looking more deeply into it.

djaglowski added a commit that referenced this pull request Sep 13, 2024
I noticed on #34720 and #35026 that execution of the test continued
beyond a failure of `require.EventuallyWithT`. Based on the description
alone, I would expect that using `assert` within
`require.EventuallyWithT` should cause execution to stop if the
assertion fails, but it appears this may not be the case. However, this
change apparently works as intended.
djaglowski added a commit that referenced this pull request Sep 20, 2024
This is a step towards #34720 which should have no user facing impact.
It consolidates the event model by removing the notion of a "raw" event.
The behavior of `raw` flag should remain the same because we still use
different functions to build the output from the unified event.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pkg/stanza receiver/windowseventlog Run Windows Enable running windows test on a PR
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[receiver/windowseventlog] Extract parsing logic
2 participants