##########################################################################
# $Id$
##########################################################################
# $Log: evtsystem,v $
# Revision 1.3  2008/06/30 23:07:51  kirk
# fixed copyright holders for files where I know who they should be
#
# Revision 1.2  2008/03/24 23:31:26  kirk
# added copyright/license notice to each script
#
# Revision 1.1  2007/04/28 22:50:24  bjorn
# Added files for Windows Event Log, by Orion Poplawski.  These are for
# Windows events logged to a server, using Snare Agent or similar.
#
##########################################################################

########################################################
## Copyright (c) 2008 Orion Poplawski
## Covered under the included MIT/X-Consortium License:
##    http://www.opensource.org/licenses/mit-license.php
## All modifications and contributions by other persons to
## this script are assumed to have been donated to the
## Logwatch project and thus assume the above copyright
## and licensing terms.  If you want to make contributions
## under your own copyright or a different license this
## must be explicitly stated in the contribution an the
## Logwatch project reserves the right to not accept such
## contributions.  If you have made significant
## contributions to this script and want to claim
## copyright please contact logwatch-devel@lists.sourceforge.net.
#########################################################

my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;

while (defined($ThisLine = <STDIN>)) {
   my ($Hostname,$Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$CategoryString,$DataString,$ExpandedString,$Extra);
   #Determine format
   if ($ThisLine =~ /MSWinEventLog\[/) {  # Snare 4
      #Parse
      ($Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
         ($ThisLine =~ /MSWinEventLog\[(\d+)\]:(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
   } elsif ($ThisLine =~ /MSWinEventLog\t/) { # Snare 3
      #Parse
      ($Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
         ($ThisLine =~ /MSWinEventLog\t(\d+)\t(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
   }
   if (!defined($Hostname)) {
      print STDERR "Cannot parse $ThisLine";
      next;
   }
   #print STDERR "ExpandedString = $ExpandedString\n";

   if ($System eq "Application Popup") {
      #Ignore these
      next if $ExpandedString =~ /Initialization Failed : The application failed to initialize because the window station is shutting down/;
      next if $ExpandedString =~ /^Application popup: Windows : Other people are logged on to this computer. Shutting down Windows might cause them to lose data\.    Do you want to continue shutting down\?$/;
      next if $ExpandedString =~ /^Application popup: Message from .*: Automatic software deployment is currently updating your system\. Please save all your documents as the the system might reboot without further notice\. Thank you\./;
      next if $ExpandedString =~ /^Application popup: Message from .*: The automated software installation utility has completed installing or updating software on your system\. No reboot was necessary\. All updates are complete\./;
   }

   if ($System eq "BTHUSB") {
      next if $ExpandedString =~ /^Windows cannot store Bluetooth authentication codes \(link keys\) on the local adapter\. Bluetooth keyboards might not work in the system BIOS during startup\.$/ and $Detail < 5;
   }

   if ($System =~ "EventLog") {
      #Ignore these
      next if $ExpandedString =~ /Microsoft \(R\) Windows \(R\) \d+\.\d+\. \d+ Service Pack \d/;
      next if $ExpandedString =~ /^The Event log service was started./;
      next if $ExpandedString =~ /^The Event log service was stopped./;
      next if $ExpandedString =~ /^The system uptime is \d+ seconds/;
   }

   if ($System =~ "LsaSrv") {
      #Ignore these
      next if $ExpandedString =~ /^A logon cache entry for user .* was the oldest entry and was removed\. The timestamp of this entry was/;
   }

   if ($System eq "Microsoft-Windows-Application-Experience") {
      #Ignore these
      next if $ExpandedString eq "The Program Compatibility Assistant service successfully performed phase two initialization.";
   }

   if ($System eq "Microsoft-Windows-DfsSvc") {
      #Ignore these
      next if $ExpandedString =~ /^DFS has finished building all namespaces\.$/;
      next if $ExpandedString =~ /^DFS server has finished initializing\.$/;
   }

   if ($System eq "Microsoft-Windows-FilterManager") {
      #Ignore these
      next if $ExpandedString =~ /^File System Filter .* has successfully loaded and registered with Filter Manager\.$/;
   }

   if ($System eq "Microsoft-Windows-Iphlpsvc") {
      #High Detail
      next if $ExpandedString =~ /^Isatap interface .* with address .* has been brought up\.$/ and $Detail < 10;
      next if $ExpandedString =~ /^Isatap interface .* is no longer active\.$/ and $Detail < 10;
   }

   if ($System eq "Microsoft-Windows-Kernel-General") {
      #High Detail
      next if $ExpandedString =~ /^The operating system started at system time/ and $Detail < 10;
      next if $ExpandedString =~ /^The operating system is shutting down at system time/ and $Detail < 10;
      #TODO - We should warn is this is big
      next if $ExpandedString =~ /^The system time has changed to .* from/;
   }

   if ($System eq "Microsoft-Windows-Kernel-Power") {
      #High Detail
      next if $ExpandedString =~ /^The system is entering sleep/ and $Detail < 10;
      next if $ExpandedString =~ /^The kernel power manager has initiated a shutdown transition\.$/ and $Detail < 10;

      #Ignore these
      next if $ExpandedString =~ /^ACPI thermal zone .* has been enumerated/;
      next if $ExpandedString =~ /^Processor \d+ in group \d+ exposes the following power management capabilities/;
   }

   if ($System eq "Microsoft-Windows-Kernel-Processor-Power") {
      #Ignore these
      next if $ExpandedString =~ /^Processor \d+ in group \d+ exposes the following:/;
   }

   if ($System eq "Microsoft-Windows-GroupPolicy") {
      #Ignore these
      next if $ExpandedString =~ /^The Group Policy settings for the (computer|user) were processed successfully\. There were no changes detected since the last successful processing of Group Policy\.$/;
      next if $ExpandedString =~ /^The Group Policy settings for the (computer|user) were processed successfully\. New settings from \d+ Group Policy objects were detected and applied\.$/ and $Detail == 0;
   }

   if ($System eq "Microsoft-Windows-Ntfs") {
      #Ignore these
      next if $ExpandedString =~ /^Volume .* is healthy\.  No action is needed\.$/;
   }

   if ($System eq "Microsoft-Windows-Power-Troubleshooter") {
      #High Detail
      next if $ExpandedString =~ /^The system has resumed from sleep/ and $Detail < 10;
   }

   if ($System eq "Microsoft-Windows-Time-Service") {
      #High Detail
      next if $ExpandedString =~ /^The time provider NtpClient is currently receiving valid time data from/ and $Detail < 10;
      next if $ExpandedString =~ /^The time service is now synchronizing the system time with the time source/ and $Detail < 10;
   }

   if ($System eq "Microsoft-Windows-WAS") {
      #High Detail
      next if $ExpandedString =~ /^A worker process with process id of .* serving application pool .* has requested a recycle because the worker process reached its allowed processing time limit/ and $Detail < 10;
   }

   if ($System eq "Microsoft-Windows-WindowsUpdateClient" or
       $System eq "Windows Update Agent") {
      #High Detail
      next if $ExpandedString =~ /^Automatic Updates is now paused\.$/ and $Detail < 10;
      
      #Updates
      if (($InstallDateTime, $Updates) = $ExpandedString =~ /^Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on (.*):  - (.*)$/) {
          $UpdatesReadyForInstall{$Hostname}->{$InstallDateTime} = $Updates;
          next;
      }
      if (($Update) = $ExpandedString =~ /^Installation Successful: Windows successfully installed the following update: (.*)$/) {
          push(@{$UpdatesInstalled{$Hostname}},$Update);
          next;
      }
      if ($ExpandedString =~ /^Restart Required:/) {
          $RestartRequired{$Hostname} = 1;
          next;
      }
   }

   if ($System eq "Microsoft-Windows-Winlogon") {
      #High Detail
      next if $ExpandedString =~ /User \w+ Notification for Customer Experience Improvement Program/ and $Detail < 10;
   }

   if ($System eq "Microsoft-Windows-WinRM") {
      #High Detail
      next if $ExpandedString =~ /^The WinRM service is listening for WS-Management requests/ and $Detail < 10;
   }

   if ($System eq "Service Control Manager") {
      #Ignore these
      next if $ExpandedString =~ /^The (.*) service entered the running state\./;
      next if $ExpandedString =~ /^The (.*) service entered the stopped state\./;
      next if $ExpandedString =~ /^The (.*) service was successfully sent a start control\./;
      next if $ExpandedString =~ /^The (.*) service was successfully sent a stop control\./;
   }

   if ($System eq "USER32") {
      #High Detail
      next if $ExpandedString =~ /^The process .* has initiated the power off of computer \w+ on behalf of user .* for the following reason: .*$/ and $Detail < 10;
   }

   if ($System eq "Virtual Disk Service") {
      #High Detail
      next if $ExpandedString =~ /Service (started|stopped)/ and $Detail < 10;
   }

   if ($System eq "atikmdag") {
      #Ignore these
      next if $ExpandedString =~ /^UVD Information$/;
      #High Detail
      next if $ExpandedString =~ /^Display is not active$/ and $Detail < 10;
   }

   if ($System eq "volsnap") {
      #Med Detail
      next if $ExpandedString =~ /^The oldest shadow copy of volume .* was deleted to keep disk space usage for shadow copies of volume .* below the user defined limit\.$/ and $Detail < 5;
   }

   next if $ExpandedString =~ /client service is started$/ and $Detail < 10;
   next if $ExpandedString =~ /started successfully\.$/ and $Detail < 10;
   next if $ExpandedString =~ /has successfully (?:started|stopped)\./ and $Detail < 10;
   next if $ExpandedString =~ /service .* (?:started|stopped)/i and $Detail < 10;
   next if $ExpandedString =~ /Module has (?:started|stopped)/ and $Detail < 10;
   next if $ExpandedString =~ /Driver initialized successfully\.$/ and $Detail < 10;
   next if $ExpandedString =~ /Network controller configured for .* link\.$/ and $Detail < 10;
   next if $ExpandedString =~ /^The driver package installation has succeeded\.$/ and $Detail < 10;
   next if $ExpandedString =~ /^The .* service entered the .* state/ and $Detail < 10;
   next if $ExpandedString =~ /^The process .* has initiated the (?:power off|restart|shutdown) of computer .* on behalf of user .* for the following reason/ and $Detail < 5;
   next if $ExpandedString =~ /^UVD Information$/;
   next if $ExpandedString =~ /Link has been established:/;

   # Add to the list
   $Systems{$System}->{"$Hostname $ExpandedString"}++;
}

# Handle high priority errors first
$System = "Microsoft-Windows-WER-SystemErrorReporting";
if (defined($Systems{$System})) {
   print "\nSYSTEM ERRORS!:\n";
   foreach $Error (sort(keys %{$Systems{$System}})) {
      print "    $Error : $Systems{$System}->{$Error} Times\n";
   }
   delete($Systems{$System});
}
print "\n";

if (keys %Systems) {
   foreach $System (sort(keys %Systems)) {
      print "\n$System\n";
      foreach $Error (sort(keys %{$Systems{$System}})) {
         print "    $Error : $Systems{$System}->{$Error} Times\n";
      }
   }
}

if (keys %UpdatesReadyForInstall or keys %UpdatesInstalled) {
   print "\nWindows Update Summary:\n";
   foreach $Hostname (sort(keys %UpdatesReadyForInstall)) {
      foreach $InstallDateTime (sort(keys %{$UpdatesReadyForInstall{$Hostname}})) {
         print "    Updates ready for install on $Hostname on $InstallDateTime:\n"; 
         print "        $UpdatesReadyForInstall{$Hostname}->{$InstallDateTime}\n";
      }
   }
   foreach $Hostname (sort(keys %UpdatesInstalled)) {
      print "    Updates successfully installed on $Hostname:\n";
      foreach $Update (@{$UpdatesInstalled{$Hostname}}) {
          print "        $Update\n";
      }
   }
   print "    Restart required on hosts: " if keys %RestartRequired;
   foreach $Hostname (sort(keys %RestartRequired)) {
      print "$Hostname ";
   }
   print "\n";
}

exit(0);

# vi: shiftwidth=3 tabstop=3 syntax=perl et
# Local Variables:
# mode: perl
# perl-indent-level: 3
# indent-tabs-mode: nil
# End: