From 8a7267c3ff52f88383579ce626cca2098d35b61e Mon Sep 17 00:00:00 2001 From: Michael Commey Date: Thu, 4 Jun 2026 16:18:08 +0000 Subject: [PATCH] consolidate windows tests --- generator/test_case_generator.go | 4 +- .../windows/event_logs/agent_config.json | 61 ---------- .../feature/windows/event_logs/parameters.yml | 80 ------------- .../event_regex_logs/agent_config.json | 88 -------------- .../windows/eventid_logs/agent_config.json | 54 --------- .../windows/eventid_logs/parameters.yml | 59 --------- .../windows/windows_events/agent_config.json | 105 ++++++++++++++++ .../parameters.yml | 112 +++++++++++++----- 8 files changed, 190 insertions(+), 373 deletions(-) delete mode 100644 test/feature/windows/event_logs/agent_config.json delete mode 100644 test/feature/windows/event_logs/parameters.yml delete mode 100644 test/feature/windows/event_regex_logs/agent_config.json delete mode 100644 test/feature/windows/eventid_logs/agent_config.json delete mode 100644 test/feature/windows/eventid_logs/parameters.yml create mode 100644 test/feature/windows/windows_events/agent_config.json rename test/feature/windows/{event_regex_logs => windows_events}/parameters.yml (54%) diff --git a/generator/test_case_generator.go b/generator/test_case_generator.go index 917958d08..69b60f012 100644 --- a/generator/test_case_generator.go +++ b/generator/test_case_generator.go @@ -283,9 +283,7 @@ var testTypeToTestConfig = map[string][]testConfig{ {testDir: "../../../test/feature/windows"}, {testDir: "../../../test/restart"}, {testDir: "../../../test/acceptance"}, - {testDir: "../../../test/feature/windows/event_logs"}, - {testDir: "../../../test/feature/windows/eventid_logs"}, - {testDir: "../../../test/feature/windows/event_regex_logs"}, + {testDir: "../../../test/feature/windows/windows_events"}, {testDir: "../../../test/log_state/logfile"}, {testDir: "../../../test/log_state/windows_event_log"}, { diff --git a/test/feature/windows/event_logs/agent_config.json b/test/feature/windows/event_logs/agent_config.json deleted file mode 100644 index 64f516115..000000000 --- a/test/feature/windows/event_logs/agent_config.json +++ /dev/null @@ -1,61 +0,0 @@ -{ - "agent": { - "debug": true - }, - "logs": { - "logs_collected": { - "windows_events": { - "collect_list": [ - { - "event_name": "Security", - "event_levels": [ - "INFORMATION", - "WARNING", - "ERROR", - "CRITICAL", - "VERBOSE" - ], - "log_group_name": "{instance_id}", - "log_stream_name": "SecurityEvent" - }, - { - "event_name": "System", - "event_levels": [ - "INFORMATION", - "WARNING", - "ERROR", - "CRITICAL", - "VERBOSE" - ], - "log_group_name": "{instance_id}", - "log_stream_name": "System" - }, - { - "event_name": "Application", - "event_levels": [ - "INFORMATION", - "WARNING", - "ERROR", - "CRITICAL", - "VERBOSE" - ], - "log_group_name": "{instance_id}", - "log_stream_name": "Application" - } - ] - }, - - "files": { - "collect_list": [ - { - "file_path": "C:/Users/Administrator/AppData/Local/Temp/test1.log", - "log_group_name": "{instance_id}", - "log_stream_name": "test1.log", - "timezone": "UTC" - } - ] - } - }, - "force_flush_interval": 5 - } -} \ No newline at end of file diff --git a/test/feature/windows/event_logs/parameters.yml b/test/feature/windows/event_logs/parameters.yml deleted file mode 100644 index 3ce260e75..000000000 --- a/test/feature/windows/event_logs/parameters.yml +++ /dev/null @@ -1,80 +0,0 @@ -# Receivers that agent needs to tests -receivers: [] - -#Test case name -test_case: "win_feature_event_log" -validate_type: "feature" -# Only support metrics/traces/logs, even in this case we validate more than logs, -# we only make this data_type as a placeholder -data_type: "logs" - -# Number of logs being written -number_monitored_logs: 1 -# Number of metrics to be sent or number of log lines being written each minute -values_per_minute: "2" -# Number of seconds the agent should run and collect the metrics. In this case, 1 minutes -agent_collection_period: 60 - -cloudwatch_agent_config: "" - -# Logs that the test needs to validate; moreover, the feature validation already has -# InstanceID as a log group; therefore, does not need to pass it -# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/validator/validators/feature/feature_validator.go#L108-L111 -# Moreover, the logs are being generated at with the generator -# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/internal/common/logs.go#L41-L64 -# and being generated with 2 logs line per minute -# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/test/feature/mac/parameters.yml#L14 -# and the collection period is 60. If X minutes, the logs line would be X * log lines - -log_validation: - - log_value: "Microsoft-Windows-Security-Auditing" - log_lines: 1 - log_stream: "SecurityEvent" - - log_value: "Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'" - log_lines: 1 - log_stream: "SecurityEvent" - - log_value: "This is a log line." - log_lines: 2 - log_stream: "test1.log" - - log_value: "# 0 - This is a log line." - log_lines: 1 - log_stream: "test1.log" - - log_value: "# 1 - This is a log line." - log_lines: 1 - log_stream: "test1.log" - - log_value: "System information log" - log_level: "Information" - log_lines: 1 - log_channel: "System" - log_stream: "System" - log_source: "WindowsEvents" - - log_value: "System warning log" - log_level: "Warning" - log_lines: 1 - log_channel: "System" - log_stream: "System" - log_source: "WindowsEvents" - - log_value: "System error log" - log_level: "Error" - log_lines: 1 - log_channel: "System" - log_stream: "System" - log_source: "WindowsEvents" - - log_value: "Application information log" - log_level: "Information" - log_lines: 1 - log_channel: "Application" - log_stream: "Application" - log_source: "WindowsEvents" - - log_value: "Application warning log" - log_level: "Warning" - log_lines: 1 - log_channel: "Application" - log_stream: "Application" - log_source: "WindowsEvents" - - log_value: "Application error log" - log_level: "Error" - log_lines: 1 - log_channel: "Application" - log_stream: "Application" - log_source: "WindowsEvents" \ No newline at end of file diff --git a/test/feature/windows/event_regex_logs/agent_config.json b/test/feature/windows/event_regex_logs/agent_config.json deleted file mode 100644 index 89272cbc6..000000000 --- a/test/feature/windows/event_regex_logs/agent_config.json +++ /dev/null @@ -1,88 +0,0 @@ -{ - "agent": { - "debug": true - }, - "logs": { - "logs_collected": { - "windows_events": { - "collect_list": [ - { - "event_name": "Application", - "log_group_name": "{instance_id}", - "log_stream_name": "ApplicationEvents", - "filters": [ - { - "type": "include", - "expression": "Database.*failed|Authentication.*|login.*" - } - ] - }, - { - "event_name": "Application", - "log_group_name": "{instance_id}", - "log_stream_name": "ApplicationEvents2", - "filters": [ - { - "type": "include", - "expression": ".*user.*" - }, - { - "type": "exclude", - "expression": ".*failed.*" - } - ] - }, - { - "event_name": "System", - "log_group_name": "{instance_id}", - "log_stream_name": "SystemEvents", - "filters": [ - { - "type": "include", - "expression": "Service.*started|CWAgent.*regex" - }, - { - "type": "exclude", - "expression": ".*stopped" - } - ] - }, - { - "event_name": "System", - "log_group_name": "{instance_id}", - "log_stream_name": "SystemEvents2", - "filters": [ - { - "type": "include", - "expression": "stopped|memory" - } - ] - }, - { - "event_name": "System", - "log_group_name": "{instance_id}", - "log_stream_name": "SystemEvents3", - "event_ids":[70], - "filters": [ - { - "type": "include", - "expression": "Insufficient.*" - } - ] - } - ] - }, - "files": { - "collect_list": [ - { - "file_path": "C:/Users/Administrator/AppData/Local/Temp/test1.log", - "log_group_name": "{instance_id}", - "log_stream_name": "test1.log", - "timezone": "UTC" - } - ] - } - }, - "force_flush_interval": 5 - } -} \ No newline at end of file diff --git a/test/feature/windows/eventid_logs/agent_config.json b/test/feature/windows/eventid_logs/agent_config.json deleted file mode 100644 index c42b7827f..000000000 --- a/test/feature/windows/eventid_logs/agent_config.json +++ /dev/null @@ -1,54 +0,0 @@ -{ - "agent": { - "debug": true - }, - "logs": { - "logs_collected": { - "windows_events": { - "collect_list": [ - { - "event_name": "System", - "event_ids": [ - 400 - ], - "log_group_name": "{instance_id}", - "log_stream_name": "SystemTest400" - }, - { - "event_name": "System", - "event_levels":[ - "ERROR" - ], - "event_ids": [ - 700 - ], - "log_group_name": "{instance_id}", - "log_stream_name": "SystemTest700" - }, - { - "event_name": "Application", - "event_levels":[ - "WARNING" - ], - "event_ids": [ - 89 - ], - "log_group_name": "{instance_id}", - "log_stream_name": "Application" - } - ] - }, - "files": { - "collect_list": [ - { - "file_path": "C:/Users/Administrator/AppData/Local/Temp/test1.log", - "log_group_name": "{instance_id}", - "log_stream_name": "test1.log", - "timezone": "UTC" - } - ] - } - }, - "force_flush_interval": 5 - } -} \ No newline at end of file diff --git a/test/feature/windows/eventid_logs/parameters.yml b/test/feature/windows/eventid_logs/parameters.yml deleted file mode 100644 index 73aba9d64..000000000 --- a/test/feature/windows/eventid_logs/parameters.yml +++ /dev/null @@ -1,59 +0,0 @@ -# Receivers that agent needs to tests -receivers: [] - -#Test case name -test_case: "win_feature_event_log" -validate_type: "feature" -# Only support metrics/traces/logs, even in this case we validate more than logs, -# we only make this data_type as a placeholder -data_type: "logs" - -# Number of logs being written -number_monitored_logs: 1 -# Number of metrics to be sent or number of log lines being written each minute -values_per_minute: "2" -# Number of seconds the agent should run and collect the metrics. In this case, 1 minutes -agent_collection_period: 60 - -cloudwatch_agent_config: "" - -# Logs that the test needs to validate; moreover, the feature validation already has -# InstanceID as a log group; therefore, does not need to pass it -# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/validator/validators/feature/feature_validator.go#L108-L111 -# Moreover, the logs are being generated at with the generator -# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/internal/common/logs.go#L41-L64 -# and being generated with 2 logs line per minute -# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/test/feature/mac/parameters.yml#L14 -# and the collection period is 60. If X minutes, the logs line would be X * log lines - -log_validation: - - log_value: "This is a log line." - log_lines: 2 - log_stream: "test1.log" - - log_value: "# 0 - This is a log line." - log_lines: 1 - log_stream: "test1.log" - - log_value: "# 1 - This is a log line." - log_lines: 1 - log_stream: "test1.log" - - log_value: "System logon-events log" - log_level: "Information" - log_event_id: 400 - log_lines: 1 - log_channel: "System" - log_stream: "SystemTest400" - log_source: "WindowsEvents" - - log_value: "Custom app error log" - log_level: "Error" - log_event_id: 700 - log_lines: 1 - log_channel: "System" - log_stream: "SystemTest700" - log_source: "WindowsEvents" - - log_value: "System buffer error log" - log_level: "Warning" - log_event_id: 89 - log_lines: 1 - log_channel: "Application" - log_stream: "Application" - log_source: "WindowsEvents" \ No newline at end of file diff --git a/test/feature/windows/windows_events/agent_config.json b/test/feature/windows/windows_events/agent_config.json new file mode 100644 index 000000000..0addb155a --- /dev/null +++ b/test/feature/windows/windows_events/agent_config.json @@ -0,0 +1,105 @@ +{ + "agent": { + "debug": true + }, + "logs": { + "logs_collected": { + "windows_events": { + "collect_list": [ + { + "event_name": "Security", + "event_levels": ["INFORMATION", "WARNING", "ERROR", "CRITICAL", "VERBOSE"], + "log_group_name": "{instance_id}", + "log_stream_name": "SecurityEvent" + }, + { + "event_name": "System", + "event_levels": ["INFORMATION", "WARNING", "ERROR", "CRITICAL", "VERBOSE"], + "log_group_name": "{instance_id}", + "log_stream_name": "System" + }, + { + "event_name": "Application", + "event_levels": ["INFORMATION", "WARNING", "ERROR", "CRITICAL", "VERBOSE"], + "log_group_name": "{instance_id}", + "log_stream_name": "Application" + }, + { + "event_name": "System", + "event_ids": [400], + "log_group_name": "{instance_id}", + "log_stream_name": "SystemTest400" + }, + { + "event_name": "System", + "event_levels": ["ERROR"], + "event_ids": [700], + "log_group_name": "{instance_id}", + "log_stream_name": "SystemTest700" + }, + { + "event_name": "Application", + "event_levels": ["WARNING"], + "event_ids": [89], + "log_group_name": "{instance_id}", + "log_stream_name": "ApplicationEventId89" + }, + { + "event_name": "Application", + "log_group_name": "{instance_id}", + "log_stream_name": "ApplicationEvents", + "filters": [ + {"type": "include", "expression": "Database.*failed|Authentication.*|login.*"} + ] + }, + { + "event_name": "Application", + "log_group_name": "{instance_id}", + "log_stream_name": "ApplicationEvents2", + "filters": [ + {"type": "include", "expression": ".*user.*"}, + {"type": "exclude", "expression": ".*failed.*"} + ] + }, + { + "event_name": "System", + "log_group_name": "{instance_id}", + "log_stream_name": "SystemEvents", + "filters": [ + {"type": "include", "expression": "Service.*started|CWAgent.*regex"}, + {"type": "exclude", "expression": ".*stopped"} + ] + }, + { + "event_name": "System", + "log_group_name": "{instance_id}", + "log_stream_name": "SystemEvents2", + "filters": [ + {"type": "include", "expression": "stopped|memory"} + ] + }, + { + "event_name": "System", + "log_group_name": "{instance_id}", + "log_stream_name": "SystemEvents3", + "event_ids": [70], + "filters": [ + {"type": "include", "expression": "Insufficient.*"} + ] + } + ] + }, + "files": { + "collect_list": [ + { + "file_path": "C:/Users/Administrator/AppData/Local/Temp/test1.log", + "log_group_name": "{instance_id}", + "log_stream_name": "test1.log", + "timezone": "UTC" + } + ] + } + }, + "force_flush_interval": 5 + } +} diff --git a/test/feature/windows/event_regex_logs/parameters.yml b/test/feature/windows/windows_events/parameters.yml similarity index 54% rename from test/feature/windows/event_regex_logs/parameters.yml rename to test/feature/windows/windows_events/parameters.yml index 13dc9a982..4c701c6ed 100644 --- a/test/feature/windows/event_regex_logs/parameters.yml +++ b/test/feature/windows/windows_events/parameters.yml @@ -1,32 +1,19 @@ -# Receivers that agent needs to tests +# Consolidated Windows Event Logs test +# Combines: event_logs (event_levels), eventid_logs (event_ids), event_regex_logs (filters) receivers: [] -#Test case name -test_case: "win_feature_event_regex_log" +test_case: "win_feature_windows_events" validate_type: "feature" -# Only support metrics/traces/logs, even in this case we validate more than logs, -# we only make this data_type as a placeholder data_type: "logs" -# Number of logs being written number_monitored_logs: 1 -# Number of metrics to be sent or number of log lines being written each minute values_per_minute: "2" -# Number of seconds the agent should run and collect the metrics. In this case, 1 minutes -agent_collection_period: 60 +agent_collection_period: 60 cloudwatch_agent_config: "" -# Logs that the test needs to validate; moreover, the feature validation already has -# InstanceID as a log group; therefore, does not need to pass it -# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/validator/validators/feature/feature_validator.go#L108-L111 -# Moreover, the logs are being generated at with the generator -# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/internal/common/logs.go#L41-L64 -# and being generated with 2 logs line per minute -# https://github.com/aws/amazon-cloudwatch-agent-test/blob/96f576e865b55de5e2aa88e4cf80b79c4d3dad70/test/feature/mac/parameters.yml#L14 -# and the collection period is 60. If X minutes, the logs line would be X * log lines - log_validation: + # File logs - log_value: "This is a log line." log_lines: 2 log_stream: "test1.log" @@ -36,6 +23,75 @@ log_validation: - log_value: "# 1 - This is a log line." log_lines: 1 log_stream: "test1.log" + - log_value: "Microsoft-Windows-Security-Auditing" + log_lines: 1 + log_stream: "SecurityEvent" + - log_value: "Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'" + log_lines: 1 + log_stream: "SecurityEvent" + + # System/Application Event Logs + - log_value: "System information log" + log_level: "Information" + log_lines: 1 + log_channel: "System" + log_stream: "System" + log_source: "WindowsEvents" + - log_value: "System warning log" + log_level: "Warning" + log_lines: 1 + log_channel: "System" + log_stream: "System" + log_source: "WindowsEvents" + - log_value: "System error log" + log_level: "Error" + log_lines: 1 + log_channel: "System" + log_stream: "System" + log_source: "WindowsEvents" + - log_value: "Application information log" + log_level: "Information" + log_lines: 1 + log_channel: "Application" + log_stream: "Application" + log_source: "WindowsEvents" + - log_value: "Application warning log" + log_level: "Warning" + log_lines: 1 + log_channel: "Application" + log_stream: "Application" + log_source: "WindowsEvents" + - log_value: "Application error log" + log_level: "Error" + log_lines: 1 + log_channel: "Application" + log_stream: "Application" + log_source: "WindowsEvents" + + # Event ID based logs + - log_value: "System logon-events log" + log_level: "Information" + log_event_id: 400 + log_lines: 1 + log_channel: "System" + log_stream: "SystemTest400" + log_source: "WindowsEvents" + - log_value: "Custom app error log" + log_level: "Error" + log_event_id: 700 + log_lines: 1 + log_channel: "System" + log_stream: "SystemTest700" + log_source: "WindowsEvents" + - log_value: "System buffer error log" + log_level: "Warning" + log_event_id: 89 + log_lines: 1 + log_channel: "Application" + log_stream: "ApplicationEventId89" + log_source: "WindowsEvents" + + # Regex filter logs - log_value: "Database connection failed" log_level: "Error" log_lines: 1 @@ -44,14 +100,21 @@ log_validation: log_source: "WindowsEvents" log_event_id: "45" - log_value: "Authentication failed for user admin" - log_level: "Warning" + log_level: "Warning" log_lines: 1 log_channel: "Application" log_stream: "ApplicationEvents" log_source: "WindowsEvents" log_event_id: "90" + - log_value: "user login successful" + log_level: "Warning" + log_lines: 1 + log_channel: "Application" + log_stream: "ApplicationEvents" + log_source: "WindowsEvents" + log_event_id: "12" - log_value: "Authentication failed for user admin" - log_level: "Warning" + log_level: "Warning" log_lines: 0 log_channel: "Application" log_stream: "ApplicationEvents2" @@ -64,13 +127,6 @@ log_validation: log_stream: "ApplicationEvents2" log_source: "WindowsEvents" log_event_id: "12" - - log_value: "user login successful" - log_level: "Warning" - log_lines: 1 - log_channel: "Application" - log_stream: "ApplicationEvents" - log_source: "WindowsEvents" - log_event_id: "12" - log_value: "Service started successfully" log_level: "Information" log_lines: 1 @@ -112,4 +168,4 @@ log_validation: log_channel: "System" log_stream: "SystemEvents3" log_source: "WindowsEvents" - log_event_id: "70" \ No newline at end of file + log_event_id: "70"