Skip to content
This repository has been archived by the owner on May 25, 2022. It is now read-only.

Fix for Windows Event Log operator in Windows Server 2022 #283

Merged
merged 3 commits into from
Oct 1, 2021

Conversation

BinaryFissionGames
Copy link
Contributor

@BinaryFissionGames BinaryFissionGames commented Oct 1, 2021

This is a port of this fix from Stanza: observIQ/stanza#456

TL;DR of the issue:
The API for EvtFormatMessage returns number of characters written to the buffer, and each character is the Windows WCHAR type, which is 2 bytes. It seems like previous versions of Windows returned a much larger size back (greater than 2x) for how many characters it had written to the provided buffer, but with Windows Server 2022 we are seeing it return the correct value, leading to try to only parse half of the returned XML.

Resolves #284

@BinaryFissionGames BinaryFissionGames requested a review from a team October 1, 2021 18:13
@jsirianni jsirianni self-requested a review October 1, 2021 19:34
@codecov
Copy link

codecov bot commented Oct 1, 2021

Codecov Report

Merging #283 (1a2ee2c) into main (efb458e) will decrease coverage by 0.1%.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##            main    #283     +/-   ##
=======================================
- Coverage   76.9%   76.8%   -0.2%     
=======================================
  Files         95      94      -1     
  Lines       4456    4410     -46     
=======================================
- Hits        3429    3389     -40     
+ Misses       707     701      -6     
  Partials     320     320             
Impacted Files Coverage Δ
operator/builtin/input/tcp/tcp.go 78.0% <0.0%> (-1.7%) ⬇️

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Windows Events is not compatible with Windows 2022
2 participants