ossec/ossec-hids — pull request #27 by gaelmuller (2014-01-30 15:27:58+00:00)
Title: add eventchannel support for ossec agent on windows vista or greater

This pull request adds a new feature to the windows agent, to be able to monitor "Application and Services Logs" that appeared with Windows Vista. This is not currently possible (OSSEC will read the "Applications" eventlog instead).

Previous discussions on this topic:
* https://groups.google.com/forum/#!searchin/ossec-list/eventlog/ossec-list/9AhapIAjMOk/SFRzG38XAQ4J
* https://groups.google.com/forum/#!msg/ossec-list/C9jmVkAmiRg/_3zj0Fw_v_EJ

For example, we can now monitor the "Microsoft-Windows-PrintService/Operational" eventlog with this config:

Microsoft-Windows-PrintService/Operational
eventchannel

By default, OSSEC will keep track of where it was before stopping, which means that it will read (at start time) all events that occured between stop and start in order not to miss any event. However, you can cancel this behaviour with the "only-future-events" parameter:

Microsoft-Windows-PrintService/Operational
eventchannel
yes

You can also use an XPATH query if you are not interrested in all the events (see the event schema to construct queries: http://msdn.microsoft.com/en-us/library/windows/desktop/aa385201%28v=vs.85%29.aspx):

System
eventchannel
yes
Event/System[EventID=7040]

With this config, OSSEC will only receive events from the "System" eventlog that have an event ID equal to 7040.

Few things to note:
* When changing the configuration, you should delete saved bookmarks (in the "bookmarks" directory) if you want to avoid unwanted behaviour (getting two much eventlog history on start)
* This relies on relatively new APIs available on Windows Vista or greater. This has two implications:
* We cannot use mingw32 to compile anymore, because it is missing these APIs. That is why this PR uses mingw-w64 (which explains a few changes in this PR not related to the added feature).
* We now have to generate two distinct installers: "ossec-win32-agent.exe" and "ossec-win32-agent-with-eventchannel.exe" because the new one cannot be used on systems older than Vista. We could have only one if we dropped compatibility with older systems (such as Windows XP). This is obvioulsy not wanted at this time.