Skip to content

Conversation

@AndreaMarangoni
Copy link
Contributor

Fixes #7340

For the time being we are only catching the exception to avoid crashing the process.
The schema description is explained on this page EventType Schema

The downside of this solution is that we are going to miss the event. In order to get those events, it should be as easy as adding the parsing of xml elements: DebugData, BinaryEventData and ProcessingErrorData. The content of those elements will be flattened out and stored into row["data"].

E.g.

getDataFromPtree("Event.EventData");
getDataFromPtree("Event.UserData");

getDataFromPtree("Event.DebugData");
getDataFromPtree("Event.BinaryEventData");
getDataFromPtree("Event.ProcessingErrorData");

Happy to add those if you are happy to.

@AndreaMarangoni AndreaMarangoni requested review from a team as code owners December 28, 2024 13:37
@directionless directionless merged commit 6c4bafd into osquery:master Dec 30, 2024
22 checks passed
@AndreaMarangoni AndreaMarangoni deleted the fix/windows_events_log_crash branch January 2, 2025 03:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Crash on querying windows_eventlog

2 participants