mirror of
https://github.com/rwinkhart/go-winio.git
synced 2026-08-30 13:56:51 -04:00
John Starks
664840fcdb
This change updates the logrus hook to sort the incoming logrus data before passing it to the tracelogging code. This is useful because it ensures that two instances of the same event have the fields in the same order, which is necessary to get WPA to line the fields up.
107 lines
2.9 KiB
Go
107 lines
2.9 KiB
Go
package etwlogrus
|
|
|
|
import (
|
|
"sort"
|
|
|
|
"github.com/Microsoft/go-winio/pkg/etw"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
// Hook is a Logrus hook which logs received events to ETW.
|
|
type Hook struct {
|
|
provider *etw.Provider
|
|
closeProvider bool
|
|
}
|
|
|
|
// NewHook registers a new ETW provider and returns a hook to log from it. The
|
|
// provider will be closed when the hook is closed.
|
|
func NewHook(providerName string) (*Hook, error) {
|
|
provider, err := etw.NewProvider(providerName, nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &Hook{provider, true}, nil
|
|
}
|
|
|
|
// NewHookFromProvider creates a new hook based on an existing ETW provider. The
|
|
// provider will not be closed when the hook is closed.
|
|
func NewHookFromProvider(provider *etw.Provider) (*Hook, error) {
|
|
return &Hook{provider, false}, nil
|
|
}
|
|
|
|
// Levels returns the set of levels that this hook wants to receive log entries
|
|
// for.
|
|
func (h *Hook) Levels() []logrus.Level {
|
|
return []logrus.Level{
|
|
logrus.TraceLevel,
|
|
logrus.DebugLevel,
|
|
logrus.InfoLevel,
|
|
logrus.WarnLevel,
|
|
logrus.ErrorLevel,
|
|
logrus.FatalLevel,
|
|
logrus.PanicLevel,
|
|
}
|
|
}
|
|
|
|
var logrusToETWLevelMap = map[logrus.Level]etw.Level{
|
|
logrus.PanicLevel: etw.LevelAlways,
|
|
logrus.FatalLevel: etw.LevelCritical,
|
|
logrus.ErrorLevel: etw.LevelError,
|
|
logrus.WarnLevel: etw.LevelWarning,
|
|
logrus.InfoLevel: etw.LevelInfo,
|
|
logrus.DebugLevel: etw.LevelVerbose,
|
|
logrus.TraceLevel: etw.LevelVerbose,
|
|
}
|
|
|
|
// Fire receives each Logrus entry as it is logged, and logs it to ETW.
|
|
func (h *Hook) Fire(e *logrus.Entry) error {
|
|
// Logrus defines more levels than ETW typically uses, but analysis is
|
|
// easiest when using a consistent set of levels across ETW providers, so we
|
|
// map the Logrus levels to ETW levels.
|
|
level := logrusToETWLevelMap[e.Level]
|
|
if !h.provider.IsEnabledForLevel(level) {
|
|
return nil
|
|
}
|
|
|
|
// Sort the fields by name so they are consistent in each instance
|
|
// of an event. Otherwise, the fields don't line up in WPA.
|
|
names := make([]string, 0, len(e.Data))
|
|
hasError := false
|
|
for k := range e.Data {
|
|
names := make([]string, 0, len(e.Data))
|
|
if k == logrus.ErrorKey {
|
|
// Always put the error last because it is optional in some events.
|
|
hasError = true
|
|
} else {
|
|
names = append(names, k)
|
|
}
|
|
}
|
|
sort.Strings(names)
|
|
|
|
// Reserve extra space for the message field.
|
|
fields := make([]etw.FieldOpt, 0, len(e.Data)+1)
|
|
fields = append(fields, etw.StringField("Message", e.Message))
|
|
for _, k := range names {
|
|
fields = append(fields, etw.SmartField(k, e.Data[k]))
|
|
}
|
|
if hasError {
|
|
fields = append(fields, etw.SmartField(logrus.ErrorKey, e.Data[logrus.ErrorKey]))
|
|
}
|
|
|
|
return h.provider.WriteEvent(
|
|
"LogrusEntry",
|
|
etw.WithEventOpts(etw.WithLevel(level)),
|
|
fields)
|
|
}
|
|
|
|
// Close cleans up the hook and closes the ETW provider. If the provder was
|
|
// registered by etwlogrus, it will be closed as part of `Close`. If the
|
|
// provider was passed in, it will not be closed.
|
|
func (h *Hook) Close() error {
|
|
if h.closeProvider {
|
|
return h.provider.Close()
|
|
}
|
|
return nil
|
|
}
|