tyler.durden/pandorafms
1
0
Fork 0
mirror of https://github.com/pandorafms/pandorafms.git synced 2025-07-31 01:35:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

2013-08-08 Ramon Novoa <rnovoa@artica.es>

Browse Source 
* modules/pandora_module_logevent.h: Updated the EventID mask. The
	  Windows Event Log Viewer seems to ignore the most significant 16
	  bits of the event id.

	* modules/pandora_module_logevent.cc: Do not discard existing
	  events when running in debug mode.



git-svn-id: https://svn.code.sf.net/p/pandora/code/trunk@8644 c3f86ba8-e40f-0410-aaad-9ba5e7f4b01f
This commit is contained in:
ramonn 2013-08-08 12:22:42 +00:00
parent 1670708dd0
commit a8375e49fe
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pandora_agents/win32/ChangeLog
View File

@ -1,3 +1,12 @@
2013-08-08 Ramon Novoa <rnovoa@artica.es>
* modules/pandora_module_logevent.h: Updated the EventID mask. The
Windows Event Log Viewer seems to ignore the most significant 16
bits of the event id.
* modules/pandora_module_logevent.cc: Do not discard existing
events when running in debug mode.
2013-06-26 Miguel de Dios <miguel.dedios@artica.es> 2013-06-26 Miguel de Dios <miguel.dedios@artica.es>
* bin/pandora_agent.conf: restored the remote_config as disabled * bin/pandora_agent.conf: restored the remote_config as disabled

6
pandora_agents/win32/modules/pandora_module_logevent.cc
View File

@ -213,8 +213,10 @@ Pandora_Module_Logevent::openLogEvent () {
// Discard existing events the first time the module is executed // Discard existing events the first time the module is executed
if (this->first_run == 1) { if (this->first_run == 1) {
this->getLogEvents (event_list, 1); this->first_run = 0;
this->first_run = 0; if (Pandora::getPandoraDebug() == false) {
this->getLogEvents (event_list, 1);
}
} }
return this->log_event; return this->log_event;

5
pandora_agents/win32/modules/pandora_module_logevent.h
View File

@ -34,7 +34,10 @@
// The EventID property equals the InstanceId with the top two bits masked off. // The EventID property equals the InstanceId with the top two bits masked off.
// See: http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlogentry.eventid.aspx // See: http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlogentry.eventid.aspx
#define EVENT_ID_MASK 0x3FFFFFFF //#define EVENT_ID_MASK 0x3FFFFFFF
// The Windows Event Log Viewer seems to ignore the most significant 16 bits.
#define EVENT_ID_MASK 0x0000FFFF
// Types for pointers to Wevtapi.dll functions // Types for pointers to Wevtapi.dll functions
typedef EVT_HANDLE WINAPI (*EvtQueryT) (EVT_HANDLE Session, LPCWSTR Path, LPCWSTR Query, DWORD Flags); typedef EVT_HANDLE WINAPI (*EvtQueryT) (EVT_HANDLE Session, LPCWSTR Path, LPCWSTR Query, DWORD Flags);