OrcCommand: GetSamples: add support for 'log' option

DFIR-ORC · Feb 11, 2021 · 1c9bcdc · 1c9bcdc
1 parent d926c91
commit 1c9bcdc
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 3 deletions.
diff --git a/src/OrcCommand/ConfigFile_GetSamples.cpp b/src/OrcCommand/ConfigFile_GetSamples.cpp
@@ -12,6 +12,8 @@
 
 #include "ConfigFile_GetSamples.h"
 
+#include "Log/UtilitiesLoggerConfiguration.h"
+
 using namespace Orc;
 using namespace Orc::Config;
 using namespace Orc::Config::Common;
@@ -77,8 +79,11 @@ HRESULT Orc::Config::GetSamples::root(ConfigItem& item)
         return hr;
     if (FAILED(hr = item.AddChild(::samples, GETSAMPLES_SAMPLES)))
         return hr;
+    // Deprecated: for compatibility with 10.0.x (was always ignored)
     if (FAILED(hr = item.AddChild(logging, GETSAMPLES_LOGGING)))
         return hr;
+    if (FAILED(hr = item.AddChild(Orc::Command::UtilitiesLoggerConfiguration::Register, GETSAMPLES_LOG)))
+        return hr;
     if (FAILED(hr = item.AddChild(L"autoruns", output, GETSAMPLES_AUTORUNS)))
         return hr;
     if (FAILED(hr = item.AddAttribute(L"nolimits", GETSAMPLES_NOLIMITS, ConfigItem::OPTION)))

diff --git a/src/OrcCommand/ConfigFile_GetSamples.h b/src/OrcCommand/ConfigFile_GetSamples.h
@@ -30,9 +30,10 @@ constexpr auto GETSAMPLES_LOCATIONS = 6L;
 constexpr auto GETSAMPLES_KNOWNLOCATIONS = 7L;
 constexpr auto GETSAMPLES_SAMPLES = 8L;
 constexpr auto GETSAMPLES_LOGGING = 9L;
-constexpr auto GETSAMPLES_AUTORUNS = 10L;
-constexpr auto GETSAMPLES_NOLIMITS = 11L;
-constexpr auto GETSAMPLES_NOSIGCHECK = 12L;
+constexpr auto GETSAMPLES_LOG = 10L;
+constexpr auto GETSAMPLES_AUTORUNS = 11L;
+constexpr auto GETSAMPLES_NOLIMITS = 12L;
+constexpr auto GETSAMPLES_NOSIGCHECK = 13L;
 
 namespace Orc::Config::GetSamples {
 ORCLIB_API HRESULT root(ConfigItem& item);

diff --git a/src/OrcCommand/GetSamples_Config.cpp b/src/OrcCommand/GetSamples_Config.cpp
@@ -71,6 +71,8 @@ HRESULT Main::GetConfigurationFromArgcArgv(int argc, const WCHAR* argv[])
 {
     HRESULT hr = E_FAIL;
 
+    UtilitiesLoggerConfiguration::Parse(argc, argv, m_utilitiesConfig.log);
+
     for (int i = 0; i < argc; i++)
     {
         switch (argv[i][0])
@@ -168,6 +170,16 @@ HRESULT Main::GetConfigurationFromConfig(const ConfigItem& configitem)
 
     ConfigFile reader;
 
+    if (configitem[GETSAMPLES_LOGGING])
+    {
+        Log::Warn(L"The '<logging> configuration element is deprecated, please use '<log>' instead");
+    }
+
+    if (configitem[GETSAMPLES_LOG])
+    {
+        UtilitiesLoggerConfiguration::Parse(configitem[GETSAMPLES_LOG], m_utilitiesConfig.log);
+    }
+
     if (FAILED(
             hr = config.samplesOutput.Configure(
                 static_cast<OutputSpec::Kind>(OutputSpec::Kind::Archive | OutputSpec::Kind::Directory),
@@ -288,6 +300,8 @@ HRESULT Main::CheckConfiguration()
 {
     HRESULT hr = E_FAIL;
 
+    UtilitiesLoggerConfiguration::Apply(m_logging, m_utilitiesConfig.log);
+
     // TODO: make a function to use also in GetThis_config.cpp
     if (!config.limits.bIgnoreLimits
         && (config.limits.dwlMaxBytesTotal == INFINITE && config.limits.dwMaxSampleCount == INFINITE))