(ev *etw.EventRecord)
| 70 | } |
| 71 | |
| 72 | func (c *Consumer) ProcessEvent(ev *etw.EventRecord) error { |
| 73 | if c.isClosing { |
| 74 | return nil |
| 75 | } |
| 76 | |
| 77 | if !c.config.EventSource.EventExists(ev.ID()) { |
| 78 | eventsUnknown.Add(1) |
| 79 | return nil |
| 80 | } |
| 81 | if event.IsCurrentProcDropped(ev.Header.ProcessID) && ev.Header.ProviderID != etw.WindowsKernelProcessGUID { |
| 82 | return nil |
| 83 | } |
| 84 | if c.config.EventSource.ExcludeEvent(ev.ID()) { |
| 85 | eventsExcluded.Add(1) |
| 86 | return nil |
| 87 | } |
| 88 | |
| 89 | eventsProcessed.Add(1) |
| 90 | evt := event.New(c.sequencer.Get(), ev) |
| 91 | |
| 92 | // Dispatch each event to the processor chain. |
| 93 | // Processors may further augment the event with |
| 94 | // useful fields or play the role of state managers. |
| 95 | // Scanning open files and registry control blocks |
| 96 | // at the beginning of the kernel trace session is an |
| 97 | // example of state management |
| 98 | var err error |
| 99 | evt, err = c.processors.ProcessEvent(evt) |
| 100 | if err != nil { |
| 101 | return err |
| 102 | } |
| 103 | if evt.WaitEnqueue { |
| 104 | return nil |
| 105 | } |
| 106 | ok, proc := c.psnap.Find(evt.PID) |
| 107 | if !ok { |
| 108 | c.psnap.Put(proc) |
| 109 | } |
| 110 | |
| 111 | // Associate process' state with the event. |
| 112 | // We only override the process' state if it hasn't |
| 113 | // been set previously such as in the situation where |
| 114 | // captures are being taken. Events that construct |
| 115 | // the process' snapshot also have attached process |
| 116 | // state, so simply by replaying the flow of these |
| 117 | // events we are able to reconstruct system-wide |
| 118 | // process state. |
| 119 | if evt.PS == nil { |
| 120 | evt.PS = proc |
| 121 | } |
| 122 | // Drop any events if it is originated by the |
| 123 | // current process, state event, or if the |
| 124 | // process image is in the exclusion list. |
| 125 | // Stack walk events are forwarded to the |
| 126 | // event queue for stack enrichment. Lastly, |
| 127 | // the filter is evaluated on the event to |
| 128 | // decide whether it should get dropped |
| 129 | if (evt.IsDropped(c.config.IsCaptureSet()) || |
nothing calls this directly
no test coverage detected