mgradwohl / coloma Goto Github PK

Add fake events to the system log for log size and potential size to see if we are wasting space.

This is likely most important for Redstone machines that nuke the logs when a new flight is installed.

There seems to be a 3 byte UTF-8 header on our stuff. Does it need to be UTF-8?

At the moment there's nothing that shouldn't be public but with unlimited private repos on any paid github accounts (i.e. mine) there's no reason this shouldn't be private.

There have been requests for a way to mark log entries as analysed - this will take some thought as to how or if we want to make this happen.

We currently have no infrastructure to allow this to happen.

Coloma should write the DateTime the logs were last pulled from the machine, and so that on subsequent execution, it only grabs events after that DateTime.

"The EventLog class uses the ancient deprecated APIs, the EventLogReader class uses the newer Vista APIs. You should avoid using EventLog at all costs and stick exclusively to EventLogReader class."

When 2016.06 ships, need to add the June KB Article and Revision.

Unsigned email tells me to pull a random .exe and run it elevated, and the code is not signed either. Hmmm 

Ran it anyway, this is a strong authenticator  but this is training the wrong behavior across the team.

Instead of uploading via file, upload via a custom telemetry event so that the device ID (and other data) goes along with the log data.

We should change the way we get the DeviceID - Currently 19% of devices are returning UNKNOWN.

In Program.cs:
'Console.WriteLine("From the following logs: system, security, hardwareevents, setup, and application");`
Nit: Recommend space between hardware and events.

Add the data to the output in a new column.

Currently this is restricted to Win10. We may need to make this work on Win8/Win8.1 for upgrade fairs.

From Crisping:

Unsigned email tells me to pull a random .exe and run it elevated, and the code is not signed either. Hmmm 

Ran it anyway, this is a strong authenticator  but this is training the wrong behavior across the team.

You can use this to track performance over time and potentially any bugs. You can use system time or a timer.

Or just wait until we override ::ReportEvent