|
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.
// See the LICENSE file in the project root for more information.
using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Diagnostics.CodeAnalysis;
using System.Diagnostics.Eventing.Reader;
using System.IO;
using System.Linq;
using System.Text;
namespace Microsoft.VisualStudio.IntegrationTest.Utilities
{
/// <summary>
/// Helper class to read the Application Event Log for Watson and .NetRuntime entries
/// </summary>
internal static class EventLogCollector
{
/// <summary>
/// The name of the Event Log to query
/// </summary>
private const string EventLogName = "Application";
/// <summary>
/// We want to get either the entries for the past day or the last 5 (whichever has a greater count)
/// </summary>
private const int MinimumEntries = 5;
/// <summary>
/// We want to get either the entries for the past day or the last 5 (whichever has a greater count)
/// </summary>
private const int DaysToGetEventsFor = 1;
/// <summary>
/// We don't want to add events that are older than a week
/// </summary>
private const int MaxDaysToGetEventsFor = 7;
/// <summary>
/// For Watson, the Provider Name in the Event Log is "Windows Error Reporting"
/// </summary>
private const string WatsonProviderName = "Windows Error Reporting";
/// <summary>
/// For Watson, the Event Id in the Event Log that we are interested in is 1001
/// </summary>
private const int WatsonEventId = 1001;
/// <summary>
/// Each entry in the EventLog has 22 Properties: 0-bucketId, 1-eventTypeId, 2-eventName, 3-response, 4-cabId, 5:14-bucketParameters P1:P10,
/// 15-attachedFiles, 16-location, 17-analysisSymbol, 18-recheck, 19-reportId, 20-reportStatus, 21-hashedBucket
/// </summary>
private const int WatsonEventLogEntryPropertyCount = 22;
/// <summary>
/// FaultBucket is the first property on the log entry
/// </summary>
private const int FaultBucketIndex = 0;
/// <summary>
/// For .DotNetRuntime, the Provider Name in the Event Log
/// </summary>
private const string DotNetProviderName = ".NET Runtime";
/// <summary>
/// The Event Id in the Event Log for .DotNetRuntime that we want to scope down to
/// 1023 - ERT_UnmanagedFailFast, 1025 - ERT_ManagedFailFast, 1026 - ERT_UnhandledException, 1027 - ERT_StackOverflow, 1028 - ERT_CodeContractFailed
/// </summary>
private static readonly ImmutableArray<int> s_dotNetEventId = ImmutableArray.Create(1023, 1024, 1025, 1026, 1027, 1028);
/// <summary>
/// List of EventNames to exclude from our search in the Event Log
/// </summary>
internal static HashSet<string> ExcludedEventNames = new HashSet<string>()
{
"VisualStudioNonFatalErrors",
"VisualStudioNonFatalErrors2"
};
/// <summary>
/// List of VS EXEs to search in the Event Log for
/// </summary>
internal static HashSet<string> VsRelatedExes = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
{
"devenv.exe",
"csc.exe",
"csi.exe",
"git.exe",
"msbuild.exe",
"MSBuildTaskHost.exe",
"mspdbsrv.exe",
"MStest.exe",
"RunTests.exe",
"ServiceHub.Host.CLR.exe",
"ServiceHub.Host.CLR.x64.exe",
"ServiceHub.Host.CLR.x86.exe",
"ServiceHub.IdentityHost.exe",
"ServiceHub.RoslynCodeAnalysisService.exe",
"ServiceHub.RoslynCodeAnalysisService32.exe",
"ServiceHub.SettingsHost.exe",
"ServiceHub.VSDetouredHost.exe",
"vbc.exe",
"VBCSCompiler.exe",
"VStest.Console.Exe",
"VSTest.DiscoveryEngine.exe",
"VSTest.DiscoveryEngine.x86.exe",
"vstest.executionengine.appcontainer.exe",
"vstest.executionengine.appcontainer.x86.exe",
"vstest.executionengine.clr20.exe",
"VSTest.executionEngine.exe",
"VSTest.executionEngine.x86.exe",
"xunit.console.exe",
"xunit.console.x86.exe",
};
/// <summary>
/// Get the WER entries for VS and VS related EXEs from the Event Log and write them to a file
/// </summary>
internal static void TryWriteWatsonEntriesToFile(string filePath)
{
try
{
// Use a HashSet to make sure the entries we add aren't duplicates (calls the Equals override from FeedbackItemWatsonEntry)
var watsonEntries = new HashSet<FeedbackItemWatsonEntry>();
// We need to search in the Application Event Log, since that's where Watson logs entries
var eventLogQuery = new EventLogQuery(EventLogName, PathType.LogName)
{
// Read events in descending order, so we can get either the last 5 entries or the past day of entries, whichever has a bigger count
ReverseDirection = true
};
var eventLogReader = new EventLogReader(eventLogQuery);
EventRecord eventLogRecord;
var watsonEntriesCount = 0;
while ((eventLogRecord = eventLogReader.ReadEvent()) != null)
{
// We only want the last 5 entries or the past day of entries, whichever has a bigger count
if (IsLastDayOrLastFiveRecentEntry(eventLogRecord, watsonEntriesCount))
{
// Filter the entries by Watson specific ones for VS EXEs
if (IsValidWatsonEntry(eventLogRecord))
{
var entry = new FeedbackItemWatsonEntry(eventLogRecord);
watsonEntries.Add(entry);
// If the entry doesn't have a valid BucketId, we don't want it to count towards the maxCount we send
if (!string.IsNullOrWhiteSpace(GetEventRecordPropertyToString(eventLogRecord, FaultBucketIndex)))
{
watsonEntriesCount++;
}
}
}
else
{
break;
}
}
if (watsonEntries.Any())
{
var watsonEntriesStringBuilder = new StringBuilder();
foreach (var entry in watsonEntries)
{
watsonEntriesStringBuilder.AppendLine($"Event Time (UTC): {entry.EventTime}");
watsonEntriesStringBuilder.AppendLine($"Application Name: {entry.ApplicationName}");
watsonEntriesStringBuilder.AppendLine($"Application Version: {entry.ApplicationVersion}");
watsonEntriesStringBuilder.AppendLine($"Faulting Module: {entry.FaultingModule}");
watsonEntriesStringBuilder.AppendLine($"Faulting Module Version: {entry.FaultingModuleVersion}");
watsonEntriesStringBuilder.AppendLine($"Event Name: {entry.EventName}");
watsonEntriesStringBuilder.AppendLine($"Cab Id: {entry.CabId}");
watsonEntriesStringBuilder.AppendLine($"Fault Bucket: {entry.FaultBucket}");
watsonEntriesStringBuilder.AppendLine($"Hashed Bucket: {entry.HashedBucket}");
watsonEntriesStringBuilder.AppendLine($"Watson Report Id: {entry.WatsonReportId}");
watsonEntriesStringBuilder.AppendLine();
}
File.WriteAllText(filePath, watsonEntriesStringBuilder.ToString());
}
}
catch (Exception ex)
{
File.WriteAllText(filePath, ex.ToString());
}
}
/// <summary>
/// Get the .NetRuntime entries from the Event Log and write them to a file
/// </summary>
internal static void TryWriteDotNetEntriesToFile(string filePath)
{
try
{
var dotNetEntries = new HashSet<FeedbackItemDotNetEntry>();
// We need to search in the Application Event Log, since that's where .NetRuntime logs entries
var eventLogQuery = new EventLogQuery(EventLogName, PathType.LogName)
{
// Read events in descending order, so we can get either the last 5 entries or the past day of entries, whichever has a bigger count
ReverseDirection = true
};
var eventLogReader = new EventLogReader(eventLogQuery);
EventRecord eventLogRecord;
while ((eventLogRecord = eventLogReader.ReadEvent()) != null)
{
// We only want the last 5 entries or the past day of entries, whichever has a bigger count
if (IsLastDayOrLastFiveRecentEntry(eventLogRecord, dotNetEntries.Count))
{
// Filter the entries by .NetRuntime specific ones
if (IsValidDotNetEntry(eventLogRecord, out var entry))
{
dotNetEntries.Add(entry);
}
}
else
{
break;
}
}
if (dotNetEntries.Any())
{
var dotNetEntriesStringBuilder = new StringBuilder();
foreach (var entry in dotNetEntries)
{
dotNetEntriesStringBuilder.AppendLine($"Event Time (UTC): {entry.EventTime}");
dotNetEntriesStringBuilder.AppendLine($"Event ID: {entry.EventId}");
dotNetEntriesStringBuilder.AppendLine($"Data: {entry.Data.Replace("\n", "\r\n")}");
dotNetEntriesStringBuilder.AppendLine();
}
File.WriteAllText(filePath, dotNetEntriesStringBuilder.ToString());
}
}
catch (Exception ex)
{
File.WriteAllText(filePath, ex.ToString());
}
}
/// <summary>
/// Returns true if this is one of the last 5 entries over the past week or the past day of entries, whichever has a bigger count
/// </summary>
/// <param name="eventLogRecord">Event entry to be checked</param>
/// <param name="entriesCount">List of already valid entries</param>
private static bool IsLastDayOrLastFiveRecentEntry(EventRecord eventLogRecord, int entriesCount)
{
// This is local time (it will be later converted to UTC when we send the feedback)
if (eventLogRecord.TimeCreated.HasValue
&& (eventLogRecord.TimeCreated.Value > DateTime.Now.AddDays(-MaxDaysToGetEventsFor))
&& ((eventLogRecord.TimeCreated.Value > DateTime.Now.AddDays(-DaysToGetEventsFor)) || (entriesCount < MinimumEntries)))
{
return true;
}
return false;
}
/// <summary>
/// Verifies if an entry is a valid Watson one by checking:
/// the provider, if it's for VS EXEs or the installer EXEs, and it's not a VisualStudioNonFatalErrors or VisualStudioNonFatalErrors2
/// </summary>
/// <param name="eventLogRecord">Entry to be checked</param>
private static bool IsValidWatsonEntry(EventRecord eventLogRecord)
{
if (StringComparer.InvariantCultureIgnoreCase.Equals(eventLogRecord.ProviderName, WatsonProviderName)
&& (eventLogRecord.Id == WatsonEventId)
&& (eventLogRecord.Properties.Count >= WatsonEventLogEntryPropertyCount)
&& (!ExcludedEventNames.Contains(GetEventRecordPropertyToString(eventLogRecord, FeedbackItemWatsonEntry.EventNameIndex)))
&& VsRelatedExes.Contains(GetEventRecordPropertyToString(eventLogRecord, FeedbackItemWatsonEntry.ApplicationNameIndex)))
{
return true;
}
return false;
}
/// <summary>
/// Verifies if an entry is a valid .NET one by checking:
/// the provider, if it's for certain event log IDs and for VS related EXEs
/// </summary>
/// <param name="eventLogRecord">Entry to be checked</param>
private static bool IsValidDotNetEntry(EventRecord eventLogRecord, [NotNullWhen(true)] out FeedbackItemDotNetEntry? dotNetEntry)
{
if (StringComparer.InvariantCultureIgnoreCase.Equals(eventLogRecord.ProviderName, DotNetProviderName)
&& s_dotNetEventId.Contains(eventLogRecord.Id))
{
dotNetEntry = new FeedbackItemDotNetEntry(eventLogRecord);
foreach (var app in VsRelatedExes)
{
if (dotNetEntry.Data.IndexOf(app, StringComparison.InvariantCultureIgnoreCase) >= 0)
{
return true;
}
}
}
dotNetEntry = null;
return false;
}
/// <summary>
/// Given the EventRecord and the index in it, get its value as a string (empty if it's null)
/// </summary>
/// <param name="eventLogRecord">EventRecord</param>
/// <param name="index">Index in the EventRecord</param>
/// <returns>string if not null or string.Empty</returns>
internal static string GetEventRecordPropertyToString(EventRecord eventLogRecord, int index)
{
if (eventLogRecord.Properties[index].Value == null)
{
return string.Empty;
}
else
{
return eventLogRecord.Properties[index].Value.ToString();
}
}
}
}
|