common

Documentation

Overview

Copyright 2018 StreamSets Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

• Constants
• Variables
• func ConvertTimeToLong(t time.Time) int64
• func ExtractString(byteData []byte) (string, error)
• func ExtractStrings(byteData []byte, stringCount uint16) []string
• type BaseEventLogReader
• type CommonConf
• type EventLogReader
• type EventLogReaderAPIType
• type EventLogReaderMode
• type SIDInfo
  • func GetSidInfo(sid *windows.SID) (*SIDInfo, error)
• type SIDType
  • func (s SIDType) GetSidTypeString() string
• type WinEventLogConf

Constants

const (
	ReadAll                      = EventLogReaderMode("ALL")
	ReadNew                      = EventLogReaderMode("NEW")
	ReaderAPITypeEventLogging    = EventLogReaderAPIType("EVENT_LOGGING")
	ReaderAPITypeWindowsEventLog = EventLogReaderAPIType("WINDOWS_EVENT_LOG")
)

Variables

var SIDTypeStringMap = map[SIDType]string{
	SIDType(1): "User",
	SIDType(2): "Group",
	SIDType(3): "Alias",
	SIDType(4): "Well Known Group",
	SIDType(5): "Alias",
	SIDType(6): "Deleted Account",
	SIDType(7): "Unknown",
	SIDType(8): "Computer",
}

https://docs.microsoft.com/en-us/windows/desktop/CIMWin32Prov/win32-useraccount

Functions

func ConvertTimeToLong

func ConvertTimeToLong(t time.Time) int64

func ExtractString

func ExtractString(byteData []byte) (string, error)

func ExtractStrings

func ExtractStrings(byteData []byte, stringCount uint16) []string

Types

type BaseEventLogReader

type BaseEventLogReader struct {
	Log          string
	Mode         EventLogReaderMode
	MaxBatchSize int
}

type CommonConf

type CommonConf struct {
	LogName       string  `ConfigDef:"type=STRING,required=true"`
	ReadMode      string  `ConfigDef:"type=STRING,required=true"`
	CustomLogName string  `ConfigDef:"type=STRING,required=true"`
	BufferSize    float64 `ConfigDef:"type=NUMBER,required=true"`
}

type EventLogReader

type EventLogReader interface {
	Open() error
	Read() ([]api.Record, error)
	GetCurrentOffset() string
	Close() error
}

type EventLogReaderAPIType

type EventLogReaderAPIType string

type EventLogReaderMode

type EventLogReaderMode string

type SIDInfo

type SIDInfo struct {
	Name    string
	Domain  string
	SIDType SIDType
}

func GetSidInfo

func GetSidInfo(sid *windows.SID) (*SIDInfo, error)

type SIDType

type SIDType uint32

func (SIDType) GetSidTypeString

func (s SIDType) GetSidTypeString() string

type WinEventLogConf

type WinEventLogConf struct {
	SubscriptionMode           string  `ConfigDef:"type=STRING,required=true"`
	MaxWaitTimeSecs            float64 `ConfigDef:"type=NUMBER,required=true"`
	RawEventPopulationStrategy string  `ConfigDef:"type=STRING,required=true"`
}