-
Notifications
You must be signed in to change notification settings - Fork 63
add local windows event log source #783
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
local event log source resource local windows source local event log docs remove typo fix log_names deny_list is a string not array of strings deny_list is a string not array of strings updated example custom source example
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thanks @rjury-sumo for creating the PR. LGTM except one point
Description: "Comma-separated list of event IDs to deny", | ||
} | ||
|
||
// "allowlist": is not implmemented yet |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can we get the allow_list
also added?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've done that, tidied up a few loose ends and fixed the two linting bugs
Also tagging Windows collection SMEs for review @jagan2221 @raunakmandaokar |
If you do want to test it works fine with this tf if you have an installed collector
|
Vijit Singhal asked me to create this as a new PR on the repo so will close this out. Closed in favour of #785 |
This PR adds support for a local windows events source for the installed collector. Like the local file source this is a special case as it can only be applied to existing installed collectors rather than to a hosted collector.
I don't have tests for this (the local file source doesn't either) - but have successfully been able to create or modify sources on a windows instance with installed collector installed using the two example configurations in the mardkdown file.
This was requested by one sumo customer and has an internal JIRA field request https://sumologic.atlassian.net/browse/FIELD-95
Closes #581