OrcCommand: UtilitiesMain: add critical log on all error execution path

DFIR-ORC · Nov 20, 2020 · fb5b061 · fb5b061
1 parent 00060bb
commit fb5b061
Show file tree

Hide file tree

Showing 4 changed files with 44 additions and 14 deletions.
diff --git a/src/OrcCommand/NTFSInfo_Config.cpp b/src/OrcCommand/NTFSInfo_Config.cpp
@@ -400,7 +400,7 @@ HRESULT Main::CheckConfiguration()
 
     if (config.locs.IsEmpty() != S_OK)
     {
-        Log::Error(
+        Log::Critical(
             L"No NTFS volumes configured for parsing. Use \"*\" to parse all mounted volumes or list the volumes you "
             L"want parsed");
         return E_INVALIDARG;

diff --git a/src/OrcCommand/USNInfo_Config.cpp b/src/OrcCommand/USNInfo_Config.cpp
@@ -120,7 +120,7 @@ HRESULT Main::CheckConfiguration()
 
     if (config.locs.IsEmpty() != S_OK)
     {
-        Log::Error(
+        Log::Critical(
             "No NTFS volumes configured for parsing. Use \"*\" to parse all mounted volumes or list the volumes you "
             "want parsed");
         return E_INVALIDARG;
@@ -139,7 +139,7 @@ HRESULT Main::CheckConfiguration()
     {
         if (FAILED(hr = ::VerifyDirectoryExists(config.output.Path.c_str())))
         {
-            Log::Error(
+            Log::Critical(
                 L"Specified file information output directory '{}' is not a directory [{}]",
                 config.output.Path,
                 SystemError(hr));

diff --git a/src/OrcCommand/UtilitiesMain.h b/src/OrcCommand/UtilitiesMain.h
@@ -788,12 +788,12 @@ class ORCLIB_API UtilitiesMain
         WSADATA wsa_data;
         if (WSAStartup(MAKEWORD(2, 2), &wsa_data))
         {
-            Log::Critical(L"Failed to initialize WinSock 2.2 [{}]", Win32Error(WSAGetLastError()));
+            Log::Error(L"Failed to initialize WinSock 2.2 [{}]", Win32Error(WSAGetLastError()));
         }
 
         if (FAILED(hr = CoInitializeEx(0, COINIT_MULTITHREADED)))
         {
-            Log::Error("Failed to initialize COM library [{}]", SystemError(hr));
+            Log::Critical(L"Failed to initialize COM library [{}]", SystemError(hr));
             return hr;
         }
 
@@ -832,9 +832,16 @@ class ORCLIB_API UtilitiesMain
                             nullptr,
                             schemaitem,
                             Orc::Config::Common::sqlschema)))
+                {
+                    Log::Critical(L"Failed to parse schema configuration item [{}]", SystemError(hr));
                     return hr;
+                }
+
                 if (FAILED(hr = Cmd.GetSchemaFromConfig(schemaitem)))
+                {
+                    Log::Critical(L"Failed to process configuration schema [{}]", SystemError(hr));
                     return hr;
+                }
             }
 
             if (UtilityT::DefaultConfiguration() != nullptr || UtilityT::ConfigurationExtension() != nullptr)
@@ -850,9 +857,16 @@ class ORCLIB_API UtilitiesMain
                             UtilityT::ConfigurationExtension(),
                             configitem,
                             UtilityT::GetXmlConfigBuilder())))
+                {
+                    Log::Critical(L"Failed to parse default configuration [{}]", SystemError(hr));
                     return hr;
+                }
+
                 if (FAILED(hr = Cmd.GetConfigurationFromConfig(configitem)))
+                {
+                    Log::Critical(L"Failed to parse xml configuration [{}]", SystemError(hr));
                     return hr;
+                }
             }
 
             if (UtilityT::LocalConfiguration() != nullptr || UtilityT::LocalConfigurationExtension() != nullptr)
@@ -870,25 +884,33 @@ class ORCLIB_API UtilitiesMain
                             UtilityT::GetXmlLocalConfigBuilder())))
                     return hr;
                 if (FAILED(hr = Cmd.GetLocalConfigurationFromConfig(configitem)))
+                {
+                    Log::Critical(L"Failed to parse local xml configuration [{}]", SystemError(hr));
                     return hr;
+                }
             }
 
             if (FAILED(hr = Cmd.GetConfigurationFromArgcArgv(argc, argv)))
+            {
+                Log::Critical(L"Failed to parse command line arguments [{}]", SystemError(hr));
                 return hr;
+            }
 
             if (FAILED(hr = Cmd.CheckConfiguration()))
+            {
+                Log::Critical(L"Failed while checking configuration [{}]", SystemError(hr));
                 return hr;
+            }
         }
         catch (std::exception& e)
         {
-            std::cerr << "std::exception during configuration evaluation" << std::endl;
-            std::cerr << "Caught " << e.what() << std::endl;
-            std::cerr << "Type " << typeid(e).name() << std::endl;
+            Log::Critical(
+                "Exception during configuration evaluation. Type: {}, Reason: {}", typeid(e).name(), e.what());
             return E_ABORT;
         }
         catch (...)
         {
-            std::cerr << "Exception during configuration evaluation" << std::endl;
+            Log::Critical("Exception during configuration evaluation");
             return E_ABORT;
         }
 
@@ -909,14 +931,13 @@ class ORCLIB_API UtilitiesMain
             hr = Cmd.Run();
             if (FAILED(hr))
             {
+                Log::Critical(L"Command failed with {}", SystemError(hr));
                 return hr;
             }
         }
         catch (std::exception& e)
         {
-            std::cerr << "std::exception during execution" << std::endl;
-            std::cerr << "Caught " << e.what() << std::endl;
-            std::cerr << "Type " << typeid(e).name() << std::endl;
+            Log::Critical("Exception during execution. Type: {}, Reason: {}", typeid(e).name(), e.what());
 
 #ifdef ORC_BUILD_BOOST_STACKTRACE
             boost::stacktrace::stacktrace();
@@ -925,7 +946,7 @@ class ORCLIB_API UtilitiesMain
         }
         catch (...)
         {
-            std::cerr << "Exception during during execution" << std::endl;
+            Log::Critical("Exception during configuration evaluation.");
 
 #ifdef ORC_BUILD_BOOST_STACKTRACE
             boost::stacktrace::stacktrace();
@@ -948,7 +969,10 @@ class ORCLIB_API UtilitiesMain
         //        Until then, always dump the backtrace with a Log::Critical
         if (Cmd.m_logging.logger().errorCount())
         {
-            Log::Critical(L"Dump log backtrace due to some previously encoutered error(s)");
+            Log::Critical(
+                L"Dump log backtrace due to some previously encoutered error(s). "
+                L"This could probably be ignored, you may NOT have encoutered any critical error. Error levels are "
+                L"being reevaluated and this backtrace could help in case of mistakes.");
         }
 
         return static_cast<int>(Cmd.m_logging.logger().errorCount() + Cmd.m_logging.logger().criticalCount());

diff --git a/src/OrcLib/Robustness.cpp b/src/OrcLib/Robustness.cpp
@@ -154,9 +154,15 @@ void Robustness::seTransFunction(unsigned int u, EXCEPTION_POINTERS* pExp)
     if (!g_termination.Block()->_bSilent)
     {
         if (g_termination.Block()->_szProcessDescr)
+        {
             wprintf(L"\n%s: ERROR: System exception: 0x%lx\n", g_termination.Block()->_szProcessDescr, u);
+            Log::Critical(L"{}: System exception: {}", g_termination.Block()->_szProcessDescr, SystemError(u));
+        }
         else
+        {
             wprintf(L"\nERROR: System exception: 0x%lx\n", u);
+            Log::Critical("System exception: {}", SystemError(u));
+        }
     }
 
     throw SystemException(u, pExp);