Function TestEventSourceStartTraces

internal/etw/source_test.go:69–149

(t *testing.T)

}

func TestEventSourceStartTraces(t *testing.T) {
	psnap := new(ps.SnapshotterMock)
	psnap.On("Write", mock.Anything).Return(nil)
	psnap.On("AddThread", mock.Anything).Return(nil)
	psnap.On("AddModule", mock.Anything).Return(nil)
	psnap.On("AddMmap", mock.Anything).Return(nil)
	psnap.On("RemoveMmap", mock.Anything, mock.Anything).Return(nil)
	psnap.On("RemoveThread", mock.Anything, mock.Anything).Return(nil)
	psnap.On("RemoveModule", mock.Anything, mock.Anything).Return(nil)
	psnap.On("FindModule", mock.Anything).Return(false, nil)
	psnap.On("FindAndPut", mock.Anything).Return(&pstypes.PS{})
	psnap.On("Find", mock.Anything).Return(true, &pstypes.PS{})
	psnap.On("Remove", mock.Anything).Return(nil)

	hsnap := new(handle.SnapshotterMock)
	hsnap.On("FindByObject", mock.Anything).Return(htypes.Handle{}, false)
	hsnap.On("FindHandles", mock.Anything).Return([]htypes.Handle{}, nil)

	var tests = []struct {
		name         string
		cfg          *config.Config
		wantSessions int
		wantFlags    []etw.EventTraceFlags
	}{
		{"start kernel logger session",
			&config.Config{
				EventSource: config.EventSourceConfig{
					EnableThreadEvents: true,
					EnableNetEvents:    true,
					EnableFileIOEvents: true,
					EnableVAMapEvents:  true,
					BufferSize:         1024,
					FlushTimer:         time.Millisecond * 2300,
				},
				Filters: &config.Filters{},
			},
			2,
			[]etw.EventTraceFlags{0x6018203, 0},
		},
		{"start kernel and security telemetry logger sessions",
			&config.Config{
				EventSource: config.EventSourceConfig{
					EnableThreadEvents:   true,
					EnableNetEvents:      true,
					EnableFileIOEvents:   true,
					EnableVAMapEvents:    true,
					EnableHandleEvents:   true,
					EnableRegistryEvents: true,
					BufferSize:           1024,
					FlushTimer:           time.Millisecond * 2300,
					EnableAuditAPIEvents: true,
				},
				Filters: &config.Filters{},
			},
			2,
			[]etw.EventTraceFlags{0x6038203, 0x80000040},
		},
	}