puppetlabs / puppetlabs-windows_eventlog

windows_eventlog

Table of Contents

1. Overview
2. Module Description - What is the windows_eventlog module?
3. Setup - The basics of getting started with windows_eventlog
   • What windows_eventloge affects
   • Beginning with windows_eventlog
4. Usage - Configuration options and additional functionality
5. Reference - An under-the-hood peek at what the module is doing and how
6. Limitations - OS compatibility, etc.
7. License
8. Development - Guide for contributing to the module

Overview

Puppet module for managing windows event logs

Module Description

The purpose of this module is to manage each of the Windows event logs, including the size, rotation and retention

Setup

What windows_eventlog affects

• Sets registry keys to manage the event log configuration

Beginning with windows_eventlog

Manage the size of the Application log:

    windows_eventlog { 'Application':
      log_path => '%SystemRoot%\system32\winevt\Logs\Application.evtx',
      log_size => 2048,
      max_log_policy => 'overwrite',
    }

Manage several custom logs under C:\Logs:

   windows_eventlog { ['Custom1', 'Custom2', 'Custom3']:
     log_path_template => 'C:\Logs\%%NAME%%.evtx',
   }

Usage

Classes and Defined Types

Defined Type: windows_eventlog

The primary definition of this module. Manages the size and rotation policy of Windows event logs

Parameters within windows_eventlog:

log_path

(Optional) The path to the log file that you want to manage.

log_size

The max size of the log file in bytes. Defaults to 1028.

max_log_policy

The retention policy for the log. Defaults to 'overwrite'.

log_path_template

(Optional) A template for log_path, where "%%NAME%%" will be replaced with the log name. Defaults to '%SystemRoot%\\system32\\winevt\\Logs\\%%NAME%%.evtx'.

Reference

Defined Types

Public Defined Types

• windows_eventlog: Manages the size and rotation policy of a Windows event log

Limitations

This module is tested on the following platforms:

• Windows 2008 R2

It is tested with the OSS version of Puppet only.

License

This codebase is licensed under the Apache2.0 licensing, however due to the nature of the codebase the open source dependencies may also use a combination of AGPL, BSD-2, BSD-3, GPL2.0, LGPL, MIT and MPL Licensing.

Development

Contributing

Please read CONTRIBUTING.md for full details on contributing to this project.

Transfer notice

This module was previously maintained by Vox Pupuli. It was migrated to Puppet/Perforce in 2023.

puppetlabs-windows_eventlog's Issues

windows_eventlog doesn't reconfigure when switching back from AutobackupLogfiles

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet:
• Ruby:
• Distribution:
• Module version:

How to reproduce (e.g Puppet code you use)

windows_eventlog { 'Security':
  log_path       => 'c:\Logs\SecurityEvents\Security.evtx',
  log_size       => '1073741824',
  max_log_policy =>  'archive'
}

then

windows_eventlog { 'Security':
  log_path       => 'c:\Logs\SecurityEvents\Security.evtx',
  log_size       => '1073741824',
  max_log_policy =>  'overwrite'
}

What are you seeing

The resource doesn't correctly set the registry value for
'HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security\AutoBackupLogFiles' back to 0

What behaviour did you expect instead

'HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security\AutoBackupLogFiles' should be 0

Output log

Any additional information you'd like to impart

I think this case logic needs to manage both registry keys for every case.
https://github.com/voxpupuli/puppet-windows_eventlog/blob/c630ccd4599a2480ff795774317fdfde5808030c/manifests/init.pp#L80

stdlib 6+ is unsupported

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: Agent 6.11.1
• Ruby: built in
• Distribution: opensource puppet agent
• Module version: 4.0.0

How to reproduce (e.g Puppet code you use)

puppet module list

What are you seeing

puppet-windows_eventlog requires 'puppetlabs-stdlib' (>= 4.13.1 < 6.0.0).

What behaviour did you expect instead

6.2.0 is the current version of stdlib. Stdlib version 5.x is keeping us from upgrading other modules that require version 6 for their respective upgrade dependencies.

Output log

Any additional information you'd like to impart

release 3.0.1-rc0

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet:
• Ruby:
• Distribution:
• Module version:

How to reproduce (e.g Puppet code you use)

I'm currently unable to update to the most recent version of puppetlabs-registry because of dependency conflicts introduced by this module. These dependencies are updated in the latest RC version of this module, but it hasn't been released to the Forge yet.

What are you seeing

What behaviour did you expect instead

Output log

Any additional information you'd like to impart

revise this module

I am going to refactor this a bit now as I have a immediate need to manage event logs and you have overall good stuff here.

I want the autoloader to just work, and not need use an include to get at the define.
It is considered bad form to put defines in init.pp so I will need to reorg. I will let you know how it goes shortly. ;)

Support of puppetlabs-registry v2.0.1?

Recent update of puppetlabs-registry (v2.0.1) breaks this module and reverting 1.1.4 breaks too many other modules.
What are the plan to update dependencies?

Thanks

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 5.4.0, 5.5.0
• Ruby:
• Distribution: Windows
• Module version: 2.0.0

How to reproduce (e.g Puppet code you use)

puppet module install puppet-windows_eventlog

What are you seeing

module install fails

What behaviour did you expect instead

module install works

Output log

Appveyor with registry 1.1.4
https://ci.appveyor.com/project/juju4/puppet-meta-harden-windows/build/1.1.x.115?fullLog=true

Notice: Preparing to install into C:/ProgramData/PuppetLabs/code/environments/production/modules ...
Notice: Downloading from https://forgeapi.puppet.com ...
Notice: Installing -- do not interrupt ...
C:/ProgramData/PuppetLabs/code/environments/production/modules
ΓööΓöÇΓö¼ puppet-windows_eventlog (v2.0.0)
  Γö£ΓöÇΓöÇ puppetlabs-registry (v1.1.4)
  ΓööΓöÇΓöÇ puppetlabs-stdlib (v4.25.1)
Notice: Preparing to install into C:/ProgramData/PuppetLabs/code/environments/production/modules ...
Notice: Downloading from https://forgeapi.puppet.com ...

Appveyor with 2.0.1
https://ci.appveyor.com/project/juju4/puppet-meta-harden-windows/build/1.1.x.116?fullLog=true

Notice: Preparing to install into C:/ProgramData/PuppetLabs/code/environments/production/modules ...
Notice: Downloading from https://forgeapi.puppet.com ...
puppet : Error: Could not install module 'puppet-windows_eventlog' (???)
At line:11 char:1
+ puppet module install puppet-windows_eventlog
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Error: C...eventlog' (???):String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 
  No version of 'puppet-windows_eventlog' can satisfy all dependencies
    Use `puppet module install --ignore-dependencies` to install only this module

validate_re fails if log_size is not a string

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet:
• Ruby:
• Distribution:
• Module version:

How to reproduce (e.g Puppet code you use)

windows_eventlog { 'Security':
    log_size => 209715200
}

What are you seeing

Error in compilation

What behaviour did you expect instead

log_size should accept numeric types.

Output log

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Function Call, validate_re(): input needs to be a String, not a Integer (file: /etc/puppetlabs/code/modules/windows_eventlog/manifests/init.pp, line: 58, column: 3) (file: /etc/puppetlabs/code/environments/jb_exchangelogging/site/profile/manifests/eventlogs.pp, line: 15) on node

Any additional information you'd like to impart

https://github.com/voxpupuli/puppet-windows_eventlog/blob/c4ab565ad87ad773b9a8b10990bffa8970565250/manifests/init.pp#L58

Suggest this is changed to:
validate_re("$log_size", '^\d*$','The log_size argument must be a number or a string representation of a number')

This link indicates the first argument needs to be quoted.

Incorrect Default log_size Value

The default MaxSize registry value should be 1048576 instead of 1028. The registry value is in bytes. Users should only use the 1028 value when setting the Maximum log size (KB) value in MMC (Windows Event Viewer.)

windows_eventlog requires old version of puppetlabs-registry and blocks its upgrade

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 6.15.0
• Ruby: built-in
• Distribution: RHEL
• Module version: 3.0.0

How to reproduce (e.g Puppet code you use)

attempt to update puppetlabs-registry

What are you seeing

'puppet-windows_eventlog' (v3.0.0) requires 'puppetlabs-registry' (>= 1.1.1 < 3.0.0)

What behaviour did you expect instead

Output log

Any additional information you'd like to impart

Current version of puppetlabs-registry is 3.1.0. Can you please support it in this module? Thank you