138 lines
3.9 KiB
Go
138 lines
3.9 KiB
Go
//go:build windows
|
|
|
|
// Package win_eventlog Input plugin to collect Windows Event Log messages
|
|
//
|
|
//revive:disable-next-line:var-naming
|
|
package win_eventlog
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
func TestWinEventLog_shouldExcludeEmptyField(t *testing.T) {
|
|
type args struct {
|
|
field string
|
|
fieldType string
|
|
fieldValue interface{}
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
w *WinEventLog
|
|
args args
|
|
wantShould bool
|
|
}{
|
|
{
|
|
name: "Not in list",
|
|
args: args{field: "qq", fieldType: "string", fieldValue: ""},
|
|
wantShould: false,
|
|
w: &WinEventLog{ExcludeEmpty: []string{"te*"}},
|
|
},
|
|
{
|
|
name: "Empty string",
|
|
args: args{field: "test", fieldType: "string", fieldValue: ""},
|
|
wantShould: true,
|
|
w: &WinEventLog{ExcludeEmpty: []string{"te*"}},
|
|
},
|
|
{
|
|
name: "Non-empty string",
|
|
args: args{field: "test", fieldType: "string", fieldValue: "qq"},
|
|
wantShould: false,
|
|
w: &WinEventLog{ExcludeEmpty: []string{"te*"}},
|
|
},
|
|
{
|
|
name: "Zero int",
|
|
args: args{field: "test", fieldType: "int", fieldValue: int(0)},
|
|
wantShould: true,
|
|
w: &WinEventLog{ExcludeEmpty: []string{"te*"}},
|
|
},
|
|
{
|
|
name: "Non-zero int",
|
|
args: args{field: "test", fieldType: "int", fieldValue: int(-1)},
|
|
wantShould: false,
|
|
w: &WinEventLog{ExcludeEmpty: []string{"te*"}},
|
|
},
|
|
{
|
|
name: "Zero uint32",
|
|
args: args{field: "test", fieldType: "uint32", fieldValue: uint32(0)},
|
|
wantShould: true,
|
|
w: &WinEventLog{ExcludeEmpty: []string{"te*"}},
|
|
},
|
|
{
|
|
name: "Non-zero uint32",
|
|
args: args{field: "test", fieldType: "uint32", fieldValue: uint32(0xc0fefeed)},
|
|
wantShould: false,
|
|
w: &WinEventLog{ExcludeEmpty: []string{"te*"}},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
if gotShould := tt.w.shouldExcludeEmptyField(tt.args.field, tt.args.fieldType, tt.args.fieldValue); gotShould != tt.wantShould {
|
|
t.Errorf("WinEventLog.shouldExcludeEmptyField() = %v, want %v", gotShould, tt.wantShould)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestWinEventLog_shouldProcessField(t *testing.T) {
|
|
tags := []string{"Source", "Level*"}
|
|
fields := []string{"EventID", "Message*"}
|
|
excluded := []string{"Message*"}
|
|
type args struct {
|
|
field string
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
w *WinEventLog
|
|
args args
|
|
wantShould bool
|
|
wantList string
|
|
}{
|
|
{
|
|
name: "Not in tags",
|
|
args: args{field: "test"},
|
|
wantShould: false,
|
|
wantList: "excluded",
|
|
w: &WinEventLog{EventTags: tags, EventFields: fields, ExcludeFields: excluded},
|
|
},
|
|
{
|
|
name: "In Tags",
|
|
args: args{field: "LevelText"},
|
|
wantShould: true,
|
|
wantList: "tags",
|
|
w: &WinEventLog{EventTags: tags, EventFields: fields, ExcludeFields: excluded},
|
|
},
|
|
{
|
|
name: "Not in Fields",
|
|
args: args{field: "EventId"},
|
|
wantShould: false,
|
|
wantList: "excluded",
|
|
w: &WinEventLog{EventTags: tags, EventFields: fields, ExcludeFields: excluded},
|
|
},
|
|
{
|
|
name: "In Fields",
|
|
args: args{field: "EventID"},
|
|
wantShould: true,
|
|
wantList: "fields",
|
|
w: &WinEventLog{EventTags: tags, EventFields: fields, ExcludeFields: excluded},
|
|
},
|
|
{
|
|
name: "In Fields and Excluded",
|
|
args: args{field: "Messages"},
|
|
wantShould: false,
|
|
wantList: "excluded",
|
|
w: &WinEventLog{EventTags: tags, EventFields: fields, ExcludeFields: excluded},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
gotShould, gotList := tt.w.shouldProcessField(tt.args.field)
|
|
if gotShould != tt.wantShould {
|
|
t.Errorf("WinEventLog.shouldProcessField() gotShould = %v, want %v", gotShould, tt.wantShould)
|
|
}
|
|
if gotList != tt.wantList {
|
|
t.Errorf("WinEventLog.shouldProcessField() gotList = %v, want %v", gotList, tt.wantList)
|
|
}
|
|
})
|
|
}
|
|
}
|