340 lines
8.8 KiB
Plaintext
340 lines
8.8 KiB
Plaintext
//////////////////////////////////////////////////////////////////////////////
|
|
// Index.mof contains:
|
|
// Index Event Generator definitions for ESSTest
|
|
//
|
|
// Event and provider definitions for:
|
|
// MSFT_EssTestIndexEvent
|
|
// MSFT_EssTestIndexEvent2
|
|
//
|
|
|
|
#pragma namespace("\\\\.\\root\\cimv2")
|
|
|
|
//////////////////////////////////////////////////////////////////////////////
|
|
// MSFT_EssTestIndexEvent (single DWORD event)
|
|
|
|
class MSFT_EssTestIndexEvent : __ExtrinsicEvent
|
|
{
|
|
uint32 Index;
|
|
};
|
|
|
|
// Fires MSFT_EssTestIndexEvent
|
|
instance of MSFT_EssEventGenerator as $Gen1
|
|
{
|
|
Name = "Index Event Generator";
|
|
CommandLine = "mofprov \"/Nroot\\cimv2\" \"/PDecoupled Index Event Generator\" \"/F%ResultsFile%\" /B0";
|
|
Script =
|
|
"PrintMOF();\n"
|
|
"\n"
|
|
"function PrintMOF()\n"
|
|
"{\n"
|
|
" var args = WScript.Arguments;\n"
|
|
"\n"
|
|
" for (Index = 0; Index < args(0); Index++)\n"
|
|
" {\n"
|
|
" if (%ScriptRule%)\n"
|
|
" {\n"
|
|
" WScript.Echo(\n"
|
|
" \"instance of MSFT_EssTestIndexEvent { Index = \" + Index + \"; }; \");\n"
|
|
" }\n"
|
|
" }\n"
|
|
"}\n";
|
|
};
|
|
|
|
instance of MSFT_EssTestWorkItem
|
|
{
|
|
Name = "Index Events";
|
|
EventGenerator = $Gen1;
|
|
|
|
Enabled = false;
|
|
NumEvents = 50000;
|
|
TimesToExecute = 1;
|
|
MaxPermConsumers = 5;
|
|
MaxTempConsumers = 5;
|
|
SlowDownProviders = true;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index Ranges: 800-850";
|
|
|
|
EventGenerator = $Gen1;
|
|
Query =
|
|
"select * from MSFT_EssTestIndexEvent where (Index >= 800 and Index <= 850)";
|
|
|
|
ScriptRule = "(Index >= 800 && Index <= 850)";
|
|
|
|
Behavior = 1;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index Ranges: 2000-2100";
|
|
|
|
EventGenerator = $Gen1;
|
|
Query =
|
|
"select * from MSFT_EssTestIndexEvent where "
|
|
"(Index >= 2000 and Index <= 2100)";
|
|
|
|
ScriptRule = "Index >= 2000 && Index <= 2100";
|
|
|
|
Behavior = 1;
|
|
OnAt = 2;
|
|
OffAt = 6;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index Ranges: 3000-3200 (on/off)";
|
|
|
|
EventGenerator = $Gen1;
|
|
Query =
|
|
"select * from MSFT_EssTestIndexEvent where "
|
|
"(Index >= 3000 and Index <= 3200)";
|
|
|
|
ScriptRule = "Index >= 3000 && Index <= 3200";
|
|
|
|
Behavior = 2;
|
|
OnAt = 2;
|
|
OffAt = 6;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index Ranges: 200-400,600-800,900-950";
|
|
|
|
EventGenerator = $Gen1;
|
|
Query =
|
|
"select * from MSFT_EssTestIndexEvent where "
|
|
"(Index >= 200 and Index <= 250) or "
|
|
"(Index >= 600 and Index <= 800) or "
|
|
"(Index >= 900 and Index <= 950)";
|
|
|
|
ScriptRule =
|
|
"(Index >= 200 && Index <= 250) || "
|
|
"(Index >= 600 && Index <= 800) || "
|
|
"(Index >= 900 && Index <= 950)";
|
|
|
|
Behavior = 1;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index Includes: 10,20,30,40,50,60,70,80,90,100";
|
|
|
|
EventGenerator = $Gen1;
|
|
Query =
|
|
"select * from MSFT_EssTestIndexEvent where "
|
|
"Index = 10 or Index = 20 or Index = 30 or "
|
|
"Index = 40 or Index = 50 or Index = 60 or "
|
|
"Index = 70 or Index = 80 or Index = 90 or "
|
|
"Index = 100";
|
|
|
|
ScriptRule =
|
|
"Index == 10 || Index == 20 || Index == 30 || "
|
|
"Index == 40 || Index == 50 || Index == 60 || "
|
|
"Index == 70 || Index == 80 || Index == 90 || "
|
|
"Index == 100";
|
|
|
|
Behavior = 1;
|
|
};
|
|
|
|
|
|
|
|
//////////////////////////////////////////////////////////////////////////////
|
|
// MSFT_EssTestIndexEvent (more complicated event)
|
|
|
|
class MSFT_EssTestIndex2Event : __ExtrinsicEvent
|
|
{
|
|
uint32 Index;
|
|
string StringParam;
|
|
object Obj;
|
|
object ObjArray[];
|
|
string StringArray[];
|
|
uint32 IntArray[];
|
|
boolean BoolArray[];
|
|
boolean BoolParam;
|
|
uint8 ByteArray[];
|
|
};
|
|
|
|
// Fires MSFT_EssTestIndex2Event
|
|
instance of MSFT_EssEventGenerator as $Gen2
|
|
{
|
|
Name = "Index2 Event Generator";
|
|
CommandLine = "mofprov \"/Nroot\\cimv2\" \"/PDecoupled Index Event Generator\" \"/F%ResultsFile%\" /B64000 /L1000 /V";
|
|
Script =
|
|
"PrintMOF();"
|
|
|
|
"function PrintMOF()\n"
|
|
"{\n"
|
|
" var args = WScript.Arguments;\n"
|
|
|
|
" for (Index = 0; Index < args(0); Index++)\n"
|
|
" {\n"
|
|
" var Class,\n"
|
|
" CurrentClockSpeed = -1,\n"
|
|
" ProcessID = -1,\n"
|
|
" SubIndex = -1,\n"
|
|
" Type = Index % 3,\n"
|
|
" Obj;\n"
|
|
|
|
" if (Type == 0)\n"
|
|
" {\n"
|
|
" Class = \"Win32_Processor\";\n"
|
|
" CurrentClockSpeed = Index % 100;\n"
|
|
|
|
" Obj = \n"
|
|
" \"instance of Win32_Processor \" +\n"
|
|
" \"{\" +\n"
|
|
" \" CurrentClockSpeed = \" + CurrentClockSpeed + \";\" +\n"
|
|
" \"}\";\n"
|
|
" }\n"
|
|
" else if (Type == 1)\n"
|
|
" {\n"
|
|
" Class = \"Win32_Process\";\n"
|
|
" ProcessID = Index % 2000;\n"
|
|
|
|
" Obj = \n"
|
|
" \"instance of Win32_Process \" +\n"
|
|
" \"{\" +\n"
|
|
" \" ProcessID = \" + ProcessID + \";\" +\n"
|
|
" \"}\";\n"
|
|
" }\n"
|
|
" else\n"
|
|
" {\n"
|
|
" Class = \"MSFT_EssTestIndex2Event\";\n"
|
|
" SubIndex = Index + 1000;\n"
|
|
|
|
" Obj = \n"
|
|
" \"instance of MSFT_EssTestIndex2Event \" +\n"
|
|
" \"{\" +\n"
|
|
" \" Index = \" + SubIndex + \";\" +\n"
|
|
" \"}\";\n"
|
|
" }\n"
|
|
|
|
" if (%ScriptRule%)\n"
|
|
" {\n"
|
|
" var strOut =\n"
|
|
" \"instance of MSFT_EssTestIndex2Event \" +\n"
|
|
" \"{\" +\n"
|
|
" \" Index = \" + Index + \";\" +\n"
|
|
" \" Obj = \" + Obj + \";\" +\n"
|
|
" \"};\"\n"
|
|
|
|
" WScript.Echo(strOut);\n"
|
|
" }\n"
|
|
" }\n"
|
|
"};\n";
|
|
|
|
};
|
|
|
|
instance of MSFT_EssTestWorkItem
|
|
{
|
|
Name = "Index2 Events";
|
|
EventGenerator = $Gen2;
|
|
|
|
Enabled = false;
|
|
NumEvents = 10000;
|
|
TimesToExecute = 1;
|
|
MaxPermConsumers = 1;
|
|
MaxTempConsumers = 0;
|
|
SlowDownProviders = true;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index2: CurrentClockSpeed >= 95";
|
|
|
|
EventGenerator = $Gen2;
|
|
Query =
|
|
"select * from MSFT_EssTestIndex2Event where Obj.CurrentClockSpeed >= 95";
|
|
|
|
ScriptRule = "CurrentClockSpeed >= 95";
|
|
|
|
Behavior = 1;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index2: (ProcessID >= 100 and ProcessID <= 125) or ProcessID = 75";
|
|
|
|
EventGenerator = $Gen2;
|
|
Query =
|
|
"select * from MSFT_EssTestIndex2Event where "
|
|
"(Obj.ProcessID >= 100 and Obj.ProcessID <= 125) or Obj.ProcessID = 75";
|
|
|
|
ScriptRule = "(ProcessID >= 100 && ProcessID <= 125) || ProcessID == 75";
|
|
|
|
Behavior = 1;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index2: ProcessID >= 500 and ProcessID < 550 (non-empty guard)";
|
|
|
|
EventGenerator = $Gen2;
|
|
Query =
|
|
"select * from MSFT_EssTestIndex2Event where "
|
|
"Obj.ProcessID >= 500 and ProcessID < 550";
|
|
|
|
ScriptRule = "ProcessID >= 500 && ProcessID < 550";
|
|
Condition = "select handle from win32_process where name = \"lsass.exe\"";
|
|
ConditionNamespace = "root\\cimv2";
|
|
|
|
Behavior = 1;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index2: ProcessID >= 600 and ProcessID < 650 (empty guard)";
|
|
|
|
EventGenerator = $Gen2;
|
|
Query =
|
|
"select * from MSFT_EssTestIndex2Event where "
|
|
"Obj.ProcessID >= 600 and ProcessID < 650";
|
|
|
|
// Because the guard will always be empty, we should expect to get no
|
|
// events sent to this filter.
|
|
ScriptRule = "1 == 0";
|
|
Condition = "select handle from win32_process where name = \"notthere.exe\"";
|
|
ConditionNamespace = "root\\cimv2";
|
|
|
|
Behavior = 1;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Index2: ProcessID >= 700 and ProcessID <= 800 (on/off)";
|
|
|
|
EventGenerator = $Gen2;
|
|
Query =
|
|
"select * from MSFT_EssTestIndex2Event where "
|
|
"Obj.ProcessID >= 600 and ProcessID < 650";
|
|
|
|
// Because the guard will always be empty, we should expect to get no
|
|
// events sent to this filter.
|
|
ScriptRule = "(ProcessID >= 700 && ProcessID <= 800)";
|
|
|
|
Behavior = 2;
|
|
OnAt = 1;
|
|
OffAt = 10;
|
|
};
|
|
|
|
//////////////////////////////////////////////////////////////////////////////
|
|
// Decoupled event provider registration.
|
|
|
|
instance of Win32PseudoProvider as $P2
|
|
{
|
|
Name = "Decoupled Index Event Generator";
|
|
};
|
|
|
|
instance of __EventProviderRegistration
|
|
{
|
|
Provider = $P2;
|
|
|
|
EventQueryList =
|
|
{
|
|
"select * from MSFT_EssTestIndexEvent",
|
|
"select * from MSFT_EssTestIndex2Event"
|
|
};
|
|
};
|