feat(dgw): emit syslogs and Windows events for important events #1491
Conversation
CBenoit
force-pushed
the
DGW-63
branch
2 times, most recently
from
dc957a2 to
a4380dc
Compare
| new (RegistryHive.LocalMachine, $"SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\{Includes.PRODUCT_NAME}", "EventMessageFile", $"[{GatewayProperties.InstallDir}]{Includes.EXECUTABLE_NAME}") | ||
| { | ||
| AttributesDefinition = "Type=string", | ||
| Win64 = project.Platform == Platform.x64, | ||
| RegistryKeyAction = RegistryKeyAction.create, | ||
| } |
There was a problem hiding this comment.
@thenextman I added a event source "Devolutions Gateway". To go along, here is a new registry key registering the event source. Does that look good to you?
There was a problem hiding this comment.
It looks fine to me; but we may want to check: does the key get removed at uninstall time? RegistryKeyAction.create implies that it won't, but on the InstallDir key I also set a custom attribute to mark the component permanent.
If the key is removed, does it break something in the event log? I never dealt with a custom .mc file before (.NET provides one for .NET applications).
There was a problem hiding this comment.
Good catch. If this key is removed we lose the formatting and localization in the Event Viewer, but we would lose that anyway when the resources are removed along the executable so it’s best to remove the registry key I think
Issue: DGW-63 Security: yes
| { | ||
| AttributesDefinition = "Type=string", | ||
| Win64 = project.Platform == Platform.x64, | ||
| RegistryKeyAction = RegistryKeyAction.createAndRemoveOnUninstall, |
There was a problem hiding this comment.
@thenextman I changed to createAndRemoveOnUninstall
CBenoit
temporarily deployed
to
publish-prod
GitHub Actions
Inactive
CBenoit
temporarily deployed
to
publish-prod
GitHub Actions
Inactive
CBenoit
temporarily deployed
to
publish-prod
GitHub Actions
Inactive
CBenoit
temporarily deployed
to
publish-prod
GitHub Actions
Inactive
CBenoit
had a problem deploying
to
publish-prod
GitHub Actions
Failure
CBenoit
had a problem deploying
to
publish-prod
GitHub Actions
Error
CBenoit
temporarily deployed
to
publish-prod
GitHub Actions
Inactive
Easier auditability of Devolutions Gateway service by emitting system wide logs.
Issue: DGW-63
Security: yes