231 lines
7.9 KiB
Plaintext
231 lines
7.9 KiB
Plaintext
|
|
/***********************************************************************
|
|
MSFT_EELEvent
|
|
************************************************************************/
|
|
|
|
class MSFT_EELEvent : MSFT_UCEventBase
|
|
{
|
|
string EventID;
|
|
string SourceSubsystemName;
|
|
string SourceSubsystemType;
|
|
string Category;
|
|
string Subcategory;
|
|
uint16 Severity;
|
|
uint16 Priority;
|
|
string Message;
|
|
__Event OriginalEvent;
|
|
string User;
|
|
datetime RollupTime;
|
|
string DeliveredBy;
|
|
string Type;
|
|
string Classification;
|
|
datetime TimeGenerated;
|
|
string ComputerName;
|
|
};
|
|
|
|
/**********************************************************************
|
|
MSFT_EELTemplateBase
|
|
***********************************************************************/
|
|
|
|
[abstract]
|
|
class MSFT_EELTemplateBase : MSFT_TemplateBase
|
|
{
|
|
[key] string Id;
|
|
string Name;
|
|
string Scope;
|
|
};
|
|
|
|
/**********************************************************************
|
|
MSFT_EELEventTemplate
|
|
***********************************************************************/
|
|
|
|
[dynamic, provider("Microsoft WMI Template Provider")]
|
|
class MSFT_EELEventTemplate : MSFT_EELTemplateBase
|
|
{
|
|
[notnull] string Filter;
|
|
string EventNamespace;
|
|
string DataQuery;
|
|
string DataNamespace;
|
|
string EventId;
|
|
string SourceSubsystemName;
|
|
string SourceSubsystemType;
|
|
string Category;
|
|
string Subcategory;
|
|
string Severity;
|
|
string Priority;
|
|
string Message;
|
|
string Type;
|
|
string Classification;
|
|
};
|
|
|
|
instance of MSFT_TemplateBuilder
|
|
{
|
|
Name = "LogEventBuilder";
|
|
Template = "MSFT_EELEventTemplate";
|
|
|
|
Target = instance of MSFT_UpdatingConsumerTemplate
|
|
{
|
|
Name = "@";
|
|
[tmpl_subst_str("%Scope%!%__CLASS%=%Name%")] Scope;
|
|
[tmpl_prop_val("Id")] Scenario;
|
|
[tmpl_prop_val("Filter")] FilterQuery;
|
|
[tmpl_prop_val("EventNamespace")] EventNamespace;
|
|
[tmpl_subst_str{"%DataQuery%"}] DataQueries;
|
|
[tmpl_prop_val("DataNamespace")] DataNamespace;
|
|
|
|
[tmpl_subst_str{
|
|
|
|
"INSERT INTO MSFT_EELEvent "
|
|
"( OriginalEvent, TimeGenerated, ComputerName "
|
|
"%!ConditionalSubstitution(\",SourceSubsystemType\",SourceSubsystemType)%"
|
|
"%!ConditionalSubstitution(\",SourceSubsystemName\",SourceSubsystemName)%"
|
|
"%!ConditionalSubstitution(\",Category\",Category)%"
|
|
"%!ConditionalSubstitution(\",SubCategory\",SubCategory)%"
|
|
"%!ConditionalSubstitution(\",Severity\",Severity)%"
|
|
"%!ConditionalSubstitution(\",Priority\",Priority)%"
|
|
"%!ConditionalSubstitution(\",Message\",Message)%"
|
|
"%!ConditionalSubstitution(\",Type\",Type)%"
|
|
"%!ConditionalSubstitution(\",Classification\",Classification)%"
|
|
"%!ConditionalSubstitution(\",EventId\",EventId)% )"
|
|
"( __THISEVENT, __NOW, __SERVER "
|
|
"%!ConditionalSubstitution(\",\",SourceSubsystemType)% %SourceSubSystemType%"
|
|
"%!ConditionalSubstitution(\",\",SourceSubsystemName)% %SourceSubsystemName%"
|
|
"%!ConditionalSubstitution(\",\",Category)% %Category%"
|
|
"%!ConditionalSubstitution(\",\",SubCategory)% %SubCategory%"
|
|
"%!ConditionalSubstitution(\",\",Severity)% %Severity%"
|
|
"%!ConditionalSubstitution(\",\",Priority)% %Priority%"
|
|
"%!ConditionalSubstitution(\",\",Message)% %Message%"
|
|
"%!ConditionalSubstitution(\",\",Type)% %Type%"
|
|
"%!ConditionalSubstitution(\",\",Classification)% %Classification%"
|
|
"%!ConditionalSubstitution(\",\",EventId)% %EventId% )"}] Commands;
|
|
|
|
};
|
|
};
|
|
|
|
/*************************************************************************
|
|
MSFT_EELEventForwardingTemplate
|
|
**************************************************************************/
|
|
|
|
[dynamic, provider("Microsoft WMI Template Provider")]
|
|
class MSFT_EELEventForwardingTemplate : MSFT_EELTemplateBase
|
|
{
|
|
string Condition; // over MSFT_EELEvent
|
|
[notnull] string Targets[];
|
|
uint32 Qos = 1;
|
|
boolean Authenticate = TRUE;
|
|
boolean Encryption = FALSE;
|
|
};
|
|
|
|
instance of MSFT_TemplateBuilder
|
|
{
|
|
Name = "LogEventFC";
|
|
Template = "MSFT_EELEventForwardingTemplate";
|
|
|
|
Target = instance of MSFT_ForwardingConsumer
|
|
{
|
|
[tmpl_subst_str("%Scope%!%__CLASS%=%Name%")] Name;
|
|
[tmpl_prop_val("Qos")] ForwardingQos;
|
|
[tmpl_prop_val("Authenticate")] Authenticate;
|
|
[tmpl_prop_val("Encryption")] Encryption;
|
|
[tmpl_prop_val("Targets")] Targets;
|
|
};
|
|
};
|
|
|
|
instance of MSFT_TemplateBuilder
|
|
{
|
|
Name = "LogEventForwardingFilterBuilder";
|
|
Template = "MSFT_EELEventForwardingTemplate";
|
|
|
|
Target = instance of MSFT_ConsumerFilterBindingTemplate
|
|
{
|
|
Name="@";
|
|
[tmpl_subst_str("%Scope%!%__CLASS%=%Name%")] Scope;
|
|
|
|
// never forward forwarding trace events that came from this object.
|
|
[tmpl_subst_str( "SELECT * FROM MSFT_EELEvent WHERE ("
|
|
"SourceSubsystemName != 'MSFT_ForwardingConsumer' OR "
|
|
"EventID = NULL OR "
|
|
"EventID != \"%Name%.LogEventForwardingTemplate\") "
|
|
"%!ConditionalSubstitution(\" AND (\",Condition)% "
|
|
"%Condition% "
|
|
"%!ConditionalSubstitution(\")\",Condition)% ")] FilterQuery;
|
|
|
|
[tmpl_prop_val("__BUILDER.LogEventFC.__RELPATH")] Instruction;
|
|
};
|
|
|
|
Order = 2;
|
|
};
|
|
|
|
/***************************************************************************
|
|
MSFT_EELForwardedEventTemplate
|
|
****************************************************************************/
|
|
|
|
[dynamic, provider("Microsoft WMI Template Provider")]
|
|
class MSFT_EELForwardedEventTemplate : MSFT_EELTemplateBase
|
|
{
|
|
string Condition; // over MSFT_ForwardedEvent where Event ISA LogEvent
|
|
};
|
|
|
|
instance of MSFT_TemplateBuilder
|
|
{
|
|
Name = "ForwardedLogEventBuilder";
|
|
Template = "MSFT_EELForwardedEventTemplate";
|
|
|
|
Target = instance of MSFT_UpdatingConsumerTemplate
|
|
{
|
|
Name = "@";
|
|
[tmpl_subst_str("%Scope%!%__CLASS%=%Name%")] Scope;
|
|
[tmpl_prop_val("Id")] Scenario;
|
|
|
|
EventNamespace = "root\\cimv2";
|
|
|
|
[tmpl_subst_str( "SELECT * FROM MSFT_ForwardedEvent "
|
|
"WHERE Event ISA 'MSFT_EELEvent' "
|
|
"%!ConditionalSubstitution(\"AND (\",Condition)% "
|
|
"%Condition%"
|
|
"%!ConditionalSubstitution(\")\",Condition)%")] FilterQuery;
|
|
|
|
[tmpl_subst_str{ "INSERT INTO MSFT_EELEvent "
|
|
"( EventId, "
|
|
"SourceSubsystemType, "
|
|
"SourceSubsystemName, "
|
|
"Category, "
|
|
"Subcategory, "
|
|
"Severity, "
|
|
"Priority, "
|
|
"Message, "
|
|
"Type, "
|
|
"Classification, "
|
|
"OriginalEvent, "
|
|
"ComputerName, "
|
|
"DeliveredBy, "
|
|
"TimeGenerated, "
|
|
"RollupTime ) "
|
|
"( __THISEVENT.Event.EventId, "
|
|
"__THISEVENT.Event.SourceSubsystemType, "
|
|
"__THISEVENT.Event.SourceSubsystemName, "
|
|
"__THISEVENT.Event.Category, "
|
|
"__THISEVENT.Event.Subcategory, "
|
|
"__THISEVENT.Event.Severity, "
|
|
"__THISEVENT.Event.Priority, "
|
|
"__THISEVENT.Event.Message, "
|
|
"__THISEVENT.Event.Type, "
|
|
"__THISEVENT.Event.Classification, "
|
|
"__THISEVENT.Event.OriginalEvent, "
|
|
"__THISEVENT.Event.ComputerName, "
|
|
"__THISEVENT.Machine, "
|
|
"__THISEVENT.Event.TimeGenerated, "
|
|
"__THISEVENT.Time )" }] Commands;
|
|
};
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|