refactor(agent): move telemetry collectors/analyzers/gather into Telemetry/

Part 3 of 5 in Monitoring/ bounded-context restructure. Split by purpose
(periodic metrics, hardcoded analyzers, backend-driven gather rules,
device info). Pure folder move + namespace update; no behavior change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Oliver Kieselbach
2026-04-16 01:38:47 +02:00
parent 317677abf6
commit 9f053279f5
34 changed files with 40 additions and 32 deletions
@@ -1,4 +1,4 @@
using AutopilotMonitor.Agent.Core.Monitoring.Collectors;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather;
using Xunit;
namespace AutopilotMonitor.Agent.Core.Tests.Collectors
@@ -1,4 +1,4 @@
using AutopilotMonitor.Agent.Core.Monitoring.Collectors;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather;
using Xunit;
namespace AutopilotMonitor.Agent.Core.Tests.Collectors
@@ -3,7 +3,7 @@ using System.Collections.Generic;
using System.Threading.Tasks;
using AutopilotMonitor.Agent.Core.Configuration;
using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Agent.Core.Monitoring.Analyzers;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Runtime
@@ -6,6 +6,8 @@ using AutopilotMonitor.Agent.Core.Configuration;
using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Agent.Core.Monitoring.Collectors;
using AutopilotMonitor.Agent.Core.Monitoring.Core;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Periodic;
using AutopilotMonitor.Agent.Core.Monitoring.Transport;
using AutopilotMonitor.Agent.Core.Monitoring.Replay;
using AutopilotMonitor.Agent.Core.Monitoring.Tracking;
@@ -7,6 +7,8 @@ using System.Threading.Tasks;
using AutopilotMonitor.Agent.Core.Configuration;
using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Agent.Core.Monitoring.Core;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather;
using AutopilotMonitor.Agent.Core.Monitoring.Transport;
using AutopilotMonitor.Shared;
@@ -138,7 +140,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Runtime
var userProfilePath = UserProfileResolver.ContainsUserProfileToken(entry.Path)
? UserProfileResolver.GetLoggedOnUserProfilePath() : null;
if (!Collectors.DiagnosticsPathGuards.IsDiagnosticsPathAllowed(entry.Path, _configuration.UnrestrictedMode, userProfilePath))
if (!DiagnosticsPathGuards.IsDiagnosticsPathAllowed(entry.Path, _configuration.UnrestrictedMode, userProfilePath))
{
_logger.Warning($"Diagnostics path blocked by guard: {entry.Path}");
continue;
@@ -8,6 +8,7 @@ using System.Threading.Tasks;
using AutopilotMonitor.Agent.Core.Configuration;
using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Agent.Core.Monitoring.Core;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo;
using AutopilotMonitor.Agent.Core.Monitoring.Transport;
using AutopilotMonitor.Agent.Core.Monitoring.Tracking;
using AutopilotMonitor.Shared;
@@ -5,6 +5,7 @@ using AutopilotMonitor.Agent.Core.Configuration;
using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Agent.Core.Monitoring.Collectors;
using AutopilotMonitor.Agent.Core.Monitoring.Core;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Periodic;
using AutopilotMonitor.Agent.Core.Monitoring.Transport;
using AutopilotMonitor.Shared;
using AutopilotMonitor.Shared.Models;
@@ -1,4 +1,4 @@
namespace AutopilotMonitor.Agent.Core.Monitoring.Analyzers
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers
{
/// <summary>
/// Represents an agent-side security or configuration analyzer.
@@ -7,7 +7,7 @@ using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Shared.Models;
using Microsoft.Win32;
namespace AutopilotMonitor.Agent.Core.Monitoring.Analyzers
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers
{
/// <summary>
/// Analyzes local administrator accounts and user profiles on the device
@@ -6,7 +6,7 @@ using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Shared.Models;
using Microsoft.Win32;
namespace AutopilotMonitor.Agent.Core.Monitoring.Analyzers
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers
{
/// <summary>
/// Collects installed software inventory from the Windows registry, normalizes
@@ -3,7 +3,7 @@ using System.Threading;
using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry
{
/// <summary>
/// Abstract base for interval-based event collectors.
@@ -4,7 +4,7 @@ using System.IO;
using System.Linq;
using System.Management;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo
{
/// <summary>
/// Partial: Static hardware specifications (CPU, RAM, Disk, BIOS, Battery, GPU).
@@ -11,7 +11,7 @@ using AutopilotMonitor.Agent.Core.Security;
using AutopilotMonitor.Shared.Models;
using Microsoft.Win32;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo
{
/// <summary>
/// Partial: Network, proxy, Autopilot profile, security (SecureBoot, BitLocker, TPM, AAD join),
@@ -11,7 +11,7 @@ using AutopilotMonitor.Agent.Core.Monitoring.Core;
using AutopilotMonitor.Shared.Models;
using Microsoft.Win32;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo
{
/// <summary>
/// Collects static and semi-static device information at enrollment startup and end.
@@ -1,6 +1,6 @@
using System;
namespace AutopilotMonitor.Agent.Core.Monitoring.Core
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo
{
/// <summary>
/// Provides device hardware and OS information via WMI and registry queries.
@@ -5,7 +5,7 @@ using System.Text;
using AutopilotMonitor.Agent.Core.Security;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather.Collectors
{
public class CommandCollector : IGatherRuleCollector
{
@@ -3,7 +3,7 @@ using System.Collections.Generic;
using System.Diagnostics.Eventing.Reader;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather.Collectors
{
public class EventLogCollector : IGatherRuleCollector
{
@@ -6,7 +6,7 @@ using AutopilotMonitor.Shared.Models;
using AutopilotMonitor.Agent.Core.Monitoring.Runtime;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather.Collectors
{
public class FileCollector : IGatherRuleCollector
{
@@ -7,7 +7,7 @@ using Newtonsoft.Json.Linq;
using AutopilotMonitor.Agent.Core.Monitoring.Runtime;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather.Collectors
{
public class JsonCollector : IGatherRuleCollector
{
@@ -9,7 +9,7 @@ using AutopilotMonitor.Shared.Models;
using AutopilotMonitor.Agent.Core.Monitoring.Runtime;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather.Collectors
{
public class LogParserCollector : IGatherRuleCollector
{
@@ -4,7 +4,7 @@ using System.Linq;
using AutopilotMonitor.Shared.Models;
using Microsoft.Win32;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather.Collectors
{
public class RegistryCollector : IGatherRuleCollector
{
@@ -4,7 +4,7 @@ using System.Linq;
using System.Management;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather.Collectors
{
public class WmiCollector : IGatherRuleCollector
{
@@ -9,7 +9,7 @@ using AutopilotMonitor.Shared.Models;
using AutopilotMonitor.Agent.Core.Monitoring.Runtime;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather.Collectors
{
public class XmlCollector : IGatherRuleCollector
{
@@ -3,7 +3,7 @@ using System.Collections.Generic;
using System.IO;
using System.Linq;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather
{
/// <summary>
/// Privacy and security guards for configurable diagnostics log paths.
@@ -4,7 +4,7 @@ using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Agent.Core.Monitoring.Tracking;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather
{
/// <summary>
/// Shared dependencies passed to each gather rule collector.
@@ -3,11 +3,11 @@ using System.Collections.Generic;
using System.Linq;
using System.Threading;
using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather.Collectors;
using AutopilotMonitor.Agent.Core.Monitoring.Tracking;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather
{
/// <summary>
/// Executes gather rules received from the backend API
@@ -5,7 +5,7 @@ using System.Linq;
using System.Reflection;
using Newtonsoft.Json.Linq;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather
{
/// <summary>
/// Privacy and security guards for GatherRule collectors.
@@ -1,7 +1,7 @@
using System.Collections.Generic;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors.GatherCollectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather
{
/// <summary>
/// Strategy interface for individual gather rule collector implementations.
@@ -7,7 +7,7 @@ using AutopilotMonitor.Agent.Core.Monitoring.Core;
using AutopilotMonitor.Agent.Core.Monitoring.Transport;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Periodic
{
/// <summary>
/// Measures the agent's own resource footprint: process CPU, memory, threads, handles,
@@ -12,7 +12,7 @@ using AutopilotMonitor.Shared.Models;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Periodic
{
/// <summary>
/// Polls OS-level Delivery Optimization status via a persistent PowerShell Runspace.
@@ -12,7 +12,7 @@ using AutopilotMonitor.Agent.Core.Security;
using AutopilotMonitor.Shared;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Periodic
{
/// <summary>
/// Detects network changes (SSID switches, wired↔wireless, IP changes) during provisioning
@@ -8,7 +8,7 @@ using AutopilotMonitor.Agent.Core.Logging;
using AutopilotMonitor.Agent.Core.Monitoring.Interop;
using AutopilotMonitor.Shared.Models;
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Periodic
{
/// <summary>
/// Collects system performance metrics (CPU, memory, disk) on a configurable interval.
@@ -298,7 +298,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Tracking
// Default IME log folder
private const string DefaultImeLogFolder = @"%ProgramData%\Microsoft\IntuneManagementExtension\Logs";
private Collectors.DeviceInfoCollector _deviceInfoCollector;
private Telemetry.DeviceInfo.DeviceInfoCollector _deviceInfoCollector;
// ConfigMgr (SCCM) co-management detection — fire-once guard
private bool _configMgrDetected;
@@ -381,7 +381,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Tracking
_imeLogPatterns = imeLogPatterns ?? new List<ImeLogPattern>();
_imeLogFolder = imeLogFolderOverride ?? DefaultImeLogFolder;
_espAndHelloTracker = espAndHelloTracker;
_deviceInfoCollector = new Collectors.DeviceInfoCollector(sessionId, tenantId, emitEvent, logger);
_deviceInfoCollector = new Telemetry.DeviceInfo.DeviceInfoCollector(sessionId, tenantId, emitEvent, logger);
// State persistence for crash recovery
var stateDirectory = @"%ProgramData%\AutopilotMonitor\State";
@@ -7,6 +7,8 @@ using AutopilotMonitor.Agent.Core.Configuration;
using AutopilotMonitor.Agent.Core.Monitoring.Collectors;
using AutopilotMonitor.Agent.Core.Monitoring.Core;
using AutopilotMonitor.Agent.Core.Monitoring.Runtime;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.DeviceInfo;
using AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Gather;
using AutopilotMonitor.Agent.Core.Monitoring.Transport;
using AutopilotMonitor.Shared;
using AutopilotMonitor.Shared.Models;