Function EventProcessorThread

RedEdr/event_processor.cpp:265–292

Thread which retrieves and processes events from EventAggregator

// Thread which retrieves and processes events from EventAggregator
DWORD WINAPI EventProcessorThread(LPVOID param) {
    try {
        size_t arrlen = 0;
        std::unique_lock<std::mutex> lock(g_EventAggregator.analyzer_shutdown_mtx);

        while (true) {
            // Block for new events
            g_EventAggregator.cv.wait(lock, [] { return g_EventAggregator.HasMoreEvents() || g_EventAggregator.done; });
            if (g_EventAggregator.done) {
                break;
            }
            // get em events
            std::vector<std::string> new_entries = g_EventAggregator.GetEvents();

            // process
            g_EventProcessor.AnalyzeNewEvents(new_entries);
        }
    }
    catch (const std::exception& e) {
        LOG_A(LOG_ERROR, "EventProcessorThread: Exception in main loop: %s", e.what());
    }
    catch (...) {
        LOG_A(LOG_ERROR, "EventProcessorThread: Unknown exception in main loop");
    }

    LOG_A(LOG_DEBUG, "!EventProcessor: Thread finished");
    return 0;
}


int InitializeEventProcessor(std::vector<HANDLE>& threads) {