mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 17:08:53 +00:00
Orbit MSI installer now includes the necessary manifest file to use windows_event_log as a logger_plugin. (#8343)
* Orbit MSI installer now includes the necessary manifest file to use windows_event_log as a logger_plugin
This commit is contained in:
Marcos Oviedo
GitHub
parent
52da2a3108
commit
131cc7eeec
4 changed files with 92 additions and 16 deletions
25
.github/workflows/fleet-and-orbit.yml
vendored
25
.github/workflows/fleet-and-orbit.yml
vendored
|
|
@ -439,7 +439,7 @@ jobs:
|
|||
Start-Sleep -Seconds $orbitMaxTimeToStartAndTeardown
|
||||
Get-Service -Name $serviceName | %{ if ($_.Status -ne "Stopped") { throw "Fleet Service test #2 failed" } }
|
||||
|
||||
#Test 3 - Check that no orbit.exe is running after service stop (updated after graceful shutdown)
|
||||
# Test 3 - Check that no orbit.exe is running after service stop (updated after graceful shutdown)
|
||||
Start-Service -Name $serviceName
|
||||
Start-Sleep -Seconds $orbitMaxTimeToStartAndTeardown
|
||||
Stop-Service -Name $serviceName
|
||||
|
|
@ -451,24 +451,12 @@ jobs:
|
|||
Start-Sleep -Seconds 3
|
||||
Get-Service -Name $serviceName | %{ if ($_.Status -ne "Running") { throw "Fleet Service test #4 failed" } }
|
||||
|
||||
#Test 5 - Check that service stops in less than $orbitMaxTimeToStartAndTeardown secs
|
||||
# Test 5 - Check that service stops in less than $orbitMaxTimeToStartAndTeardown secs
|
||||
Start-Job { Stop-Service -Name $args[0] } -ArgumentList $serviceName | Out-Null #async operation
|
||||
Start-Sleep -Seconds $orbitMaxTimeToStartAndTeardown
|
||||
Get-Service -Name $serviceName | %{ if ($_.Status -ne "Stopped") { throw "Fleet Service test #5 failed" } }
|
||||
|
||||
#Test 6 - Check that no osqueryd process is running once service stops (updated after graceful shutdown)
|
||||
Start-Service -Name $serviceName
|
||||
Start-Sleep -Seconds $orbitMaxTimeToStartAndTeardown # orbit takes some time to spawn osquery and desktop app due to update check
|
||||
Stop-Service -Name $serviceName
|
||||
Start-Sleep -Seconds ($orbitMaxTimeToStartAndTeardown * 10) # there is an issue with osqueryd runner intertupt that needs to be tracked down
|
||||
Get-Process | %{ if ($_.Name -eq "osqueryd") { throw "Fleet Service test #6 failed" } }
|
||||
|
||||
# Test 7 - Check that no fleet-desktop process is running once service stops
|
||||
Start-Service -Name $serviceName
|
||||
Start-Sleep -Seconds $orbitMaxTimeToStartAndTeardown # orbit takes some time to spawn osquery and desktop app due to update check
|
||||
Stop-Service -Name $serviceName
|
||||
Start-Sleep -Seconds ($orbitMaxTimeToStartAndTeardown * 10) # there is an issue with fleet-desktop runner interrupt that needs to be tracked down
|
||||
Get-Process | %{ if ($_.Name -eq "fleet-desktop") { throw "Fleet Service test #7 failed" } }
|
||||
|
||||
# There is an sporadic issue with --insecure flag being used and osqueryd which causes long shutdown time, not testing this scenario until issue this scenario is sorted out
|
||||
|
||||
- name: MSI Installer Tests
|
||||
shell: pwsh
|
||||
|
|
@ -499,6 +487,11 @@ jobs:
|
|||
Get-Service -Name $serviceName -ErrorAction SilentlyContinue | %{ if ($_.Name) { throw "MSI Installer test #3 failed" } }
|
||||
if (((Get-ChildItem -Path $registryPath -ErrorAction SilentlyContinue | Measure-Object).Count) -gt 0) { throw "MSI Installer test #3 failed" }
|
||||
|
||||
# Test 4 - Check that osquery manifest is present and that it points to the expected osqueryd.exe file
|
||||
msiexec /i ${{ steps.download.outputs.download-path }}\fleet-osquery.msi /quiet /passive /lv logtest4.txt
|
||||
Start-Sleep -Seconds $installerExecTime
|
||||
Get-Content "$Env:Programfiles\Orbit\osquery.man" | % { if($_ -match 'resourceFileName=\"(.*?)\"') { if (-not (Test-Path -Path ([System.Environment]::ExpandEnvironmentVariables($Matches[1])))) { throw "MSI Installer test #4 failed" } } }
|
||||
|
||||
- name: Upload Orbit logs
|
||||
if: always()
|
||||
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v2
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
* Orbit MSI installer now includes the necessary manifest file to use windows_event_log as a logger_plugin.
|
||||
|
|
@ -87,6 +87,10 @@ func BuildMSI(opt Options) (string, error) {
|
|||
}
|
||||
}
|
||||
|
||||
if err := writeEventLogFile(opt, orbitRoot); err != nil {
|
||||
return "", fmt.Errorf("write eventlog file: %w", err)
|
||||
}
|
||||
|
||||
if err := writeWixFile(opt, tmpDir); err != nil {
|
||||
return "", fmt.Errorf("write wix file: %w", err)
|
||||
}
|
||||
|
|
@ -151,3 +155,22 @@ func writeWixFile(opt Options, rootPath string) error {
|
|||
|
||||
return nil
|
||||
}
|
||||
|
||||
func writeEventLogFile(opt Options, rootPath string) error {
|
||||
// Eventlog manifest is going to be built and dumped into working directory
|
||||
path := filepath.Join(rootPath, "osquery.man")
|
||||
if err := secure.MkdirAll(filepath.Dir(path), constant.DefaultDirMode); err != nil {
|
||||
return fmt.Errorf("event log manifest creation: %w", err)
|
||||
}
|
||||
|
||||
var contents bytes.Buffer
|
||||
if err := windowsOsqueryEventLogTemplate.Execute(&contents, opt); err != nil {
|
||||
return fmt.Errorf("event log manifest creation: %w", err)
|
||||
}
|
||||
|
||||
if err := ioutil.WriteFile(path, contents.Bytes(), constant.DefaultFileMode); err != nil {
|
||||
return fmt.Errorf("event log manifest creation: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
|
|
|||
|
|
@ -102,3 +102,62 @@ var windowsWixTemplate = template.Must(template.New("").Option("missingkey=error
|
|||
</Product>
|
||||
</Wix>
|
||||
`))
|
||||
|
||||
var windowsOsqueryEventLogTemplate = template.Must(template.New("").Option("missingkey=error").Parse(
|
||||
`<?xml version="1.0"?>
|
||||
<instrumentationManifest xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd" xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:trace="http://schemas.microsoft.com/win/2004/08/events/trace">
|
||||
<instrumentation>
|
||||
<events>
|
||||
<provider name="FleetDM" guid="{F7740E18-3259-434F-9759-976319968900}" symbol="OsqueryWindowsEventLogProvider" resourceFileName="%systemdrive%\Program Files\Orbit\bin\osqueryd\windows\{{ .OsquerydChannel }}\osqueryd.exe" messageFileName="%systemdrive%\Program Files\Orbit\bin\osqueryd\windows\{{ .OsquerydChannel }}\osqueryd.exe">
|
||||
<events>
|
||||
<event symbol="DebugMessage" value="1" version="0" channel="osquery" level="win:Warning" task="LogMessage" opcode="MessageOpcode" template="_template_message" keywords="DebugWindowsEventLogMessage " message="$(string.osquery.event.1.message)"></event>
|
||||
<event symbol="InfoMessage" value="2" version="0" channel="osquery" level="win:Informational" task="LogMessage" opcode="MessageOpcode" template="_template_message" keywords="InfoWindowsEventLogMessage " message="$(string.osquery.event.2.message)"></event>
|
||||
<event symbol="WarningMessage" value="3" version="0" channel="osquery" level="win:Warning" task="LogMessage" opcode="MessageOpcode" template="_template_message" keywords="WarningWindowsEventLogMessage " message="$(string.osquery.event.3.message)"></event>
|
||||
<event symbol="ErrorMessage" value="4" version="0" channel="osquery" level="win:Error" task="LogMessage" opcode="MessageOpcode" template="_template_message" keywords="ErrorWindowsEventLogMessage " message="$(string.osquery.event.4.message)"></event>
|
||||
<event symbol="FatalMessage" value="5" version="0" channel="osquery" level="win:Critical" task="LogMessage" opcode="MessageOpcode" template="_template_message" keywords="FatalWindowsEventLogMessage " message="$(string.osquery.event.5.message)"></event>
|
||||
</events>
|
||||
<levels></levels>
|
||||
<tasks>
|
||||
<task name="LogMessage" symbol="WindowsEventLogMessage" value="1" eventGUID="{D3C2B9E0-4AFE-41BD-99BE-F00EE4DFEB17}"></task>
|
||||
</tasks>
|
||||
<opcodes>
|
||||
<opcode name="MessageOpcode" symbol="_opcode_message" value="10"></opcode>
|
||||
</opcodes>
|
||||
<channels>
|
||||
<channel name="osquery" chid="osquery" symbol="OsqueryWindowsEventLogChannel" type="Admin" enabled="true" message="$(string.osquery.channel.PrimaryWindowsEventLogChannel.message)"></channel>
|
||||
</channels>
|
||||
<keywords>
|
||||
<keyword name="InfoWindowsEventLogMessage" symbol="_keyword_info_message" mask="0x1"></keyword>
|
||||
<keyword name="WarningWindowsEventLogMessage" symbol="_keyword_warning_message" mask="0x2"></keyword>
|
||||
<keyword name="ErrorWindowsEventLogMessage" symbol="_keyword_error_message" mask="0x4"></keyword>
|
||||
<keyword name="FatalWindowsEventLogMessage" symbol="_keyword_fatal_message" mask="0x8"></keyword>
|
||||
<keyword name="DebugWindowsEventLogMessage" symbol="_keyword_debug_message" mask="0x10"></keyword>
|
||||
</keywords>
|
||||
<templates>
|
||||
<template tid="_template_message">
|
||||
<data name="Message" inType="win:AnsiString" outType="xs:string"></data>
|
||||
<data name="Location" inType="win:AnsiString" outType="xs:string"></data>
|
||||
</template>
|
||||
</templates>
|
||||
</provider>
|
||||
</events>
|
||||
</instrumentation>
|
||||
<localization>
|
||||
<resources culture="en-US">
|
||||
<stringTable>
|
||||
<string id="osquery.event.5.message" value="Fatal error"></string>
|
||||
<string id="osquery.event.4.message" value="Error"></string>
|
||||
<string id="osquery.event.3.message" value="Warning"></string>
|
||||
<string id="osquery.event.2.message" value="Information"></string>
|
||||
<string id="osquery.event.1.message" value="Debug"></string>
|
||||
<string id="osquery.channel.PrimaryWindowsEventLogChannel.message" value="osquery"></string>
|
||||
<string id="level.Warning" value="Warning"></string>
|
||||
<string id="level.Verbose" value="Verbose"></string>
|
||||
<string id="level.Informational" value="Information"></string>
|
||||
<string id="level.Error" value="Error"></string>
|
||||
<string id="level.Critical" value="Critical"></string>
|
||||
</stringTable>
|
||||
</resources>
|
||||
</localization>
|
||||
</instrumentationManifest>
|
||||
`))
|
||||
|
|
|
|||
Loading…
Reference in a new issue