mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
197de1d718
IME's trace listener opens every log once per process with FileMode.Append and FileShare.ReadWrite and writes at its own stream position afterwards. AgentExecutor.exe (two processes per user-context script, one per detection script) has such a listener on AgentExecutor.log and on IntuneManagementExtension.log, so a process that resumes logging after another one appended overwrites those bytes: the final file holds the last writer, a byte-position tailer has read the first version. Session 46749560 lost 6 of 16 platform-script results and 4 of 16 executor end blocks with every tracker health counter at zero — results fell back to the exit code (one Success where IME said Failed), one finished script stayed Incomplete. The agentexecutor_fallback results in the fleet are this race, not late IME logging. The tracker now keeps a fingerprint ledger of every entry it processed from the two multi-writer files (FNV-1a 64 over the decoded bytes, one CmTraceEntryAssembler shared by the read loop and the verification so entry boundaries are identical by construction), verifies it on every script end signal, on a byte-budgeted cadence while an invocation is in flight (256 KB/s, at least 1 s apart), in a 4 KB guard zone on every growth pass and on a fragment at the bookmark, and rewinds to the first changed entry; entries whose (offset, hash) still read unchanged are skipped, everything else is processed as backlog (never fresh, never a calibration anchor). The policyId-less executor lines are owned by the nearest preceding invocation marker in their file (PS-AGENT-ARG opens, PS-AGENT-SCRIPT-START upgrades to the platform script, PS-AGENT-INVOCATION and PS-AGENT-COMPLETED close) instead of a last-started pointer, so an end block a rewind uncovers reaches its own script. Restart seeds the ledger from the 64 KB behind the persisted bookmark; a rollover clears it. Four restart-safe counters (ime_overwrite_rewinds, ime_overwrite_bytes_reprocessed, ime_verify_passes, ime_verified_bytes) ride agent_metrics_snapshot and ime_pattern_hits — recovered data, not skipped work, no new event type. Tests: ImeLogTrackerOverwriteRewindTests (15) drive the positional-overwrite write pattern against both files, including the two field scenarios with the shipped patterns; agent suite 2921 green, backend known-actions list extended for the two new patterns. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
108 lines
3.7 KiB
JSON
108 lines
3.7 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://raw.githubusercontent.com/OliverKieselbach/Autopilot-Monitor/main/rules/schema/ime-log-pattern.schema.json",
|
|
"title": "Autopilot Monitor IME Log Pattern",
|
|
"description": "Defines a regex pattern for Intune Management Extension (IME) log parsing during Autopilot enrollment.",
|
|
"oneOf": [
|
|
{ "$ref": "#/$defs/imeLogPattern" },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": { "type": "string" },
|
|
"rules": {
|
|
"type": "array",
|
|
"items": { "$ref": "#/$defs/imeLogPattern" }
|
|
}
|
|
},
|
|
"required": ["rules"],
|
|
"additionalProperties": false
|
|
}
|
|
],
|
|
"$defs": {
|
|
"imeLogPattern": {
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": {
|
|
"type": "string",
|
|
"description": "JSON Schema reference for editor IntelliSense."
|
|
},
|
|
"patternId": {
|
|
"type": "string",
|
|
"description": "Unique pattern identifier (e.g., \"IME-ESP-PHASE\")."
|
|
},
|
|
"category": {
|
|
"type": "string",
|
|
"description": "Pattern category controlling when the pattern is active.",
|
|
"enum": ["always", "currentPhase", "otherPhases"]
|
|
},
|
|
"pattern": {
|
|
"type": "string",
|
|
"description": "Regex pattern string to match against IME log message content. Supports named capture groups. Uses {GUID} as placeholder for the standard GUID capture pattern."
|
|
},
|
|
"action": {
|
|
"type": "string",
|
|
"description": "Action to perform when the pattern matches. Must match an action handler in the agent's ImeLogTracker.",
|
|
"enum": [
|
|
"setCurrentApp",
|
|
"updateStateInstalled",
|
|
"updateStateDownloading",
|
|
"updateStateInstalling",
|
|
"updateStateSkipped",
|
|
"updateStateError",
|
|
"updateStatePostponed",
|
|
"espPhaseDetected",
|
|
"imeStarted",
|
|
"policiesDiscovered",
|
|
"ignoreCompletedApp",
|
|
"imeAgentVersion",
|
|
"espTrackStatus",
|
|
"updateName",
|
|
"updateWin32AppState",
|
|
"cancelStuckAndSetCurrent",
|
|
"imeSessionChange",
|
|
"imeImpersonation",
|
|
"imeTokenFailure",
|
|
"enrollmentCompleted",
|
|
"userSessionZeroApps",
|
|
"updateDoTelemetry",
|
|
"scriptStarted",
|
|
"scriptContext",
|
|
"scriptExitCode",
|
|
"scriptOutput",
|
|
"scriptCompleted",
|
|
"resetPlatformScriptContext",
|
|
"agentInvocationArgument",
|
|
"agentExecutorCompleted",
|
|
"healthScriptResult",
|
|
"healthScriptDetectionResult",
|
|
"captureExitCode",
|
|
"captureHResult",
|
|
"captureAppVersion",
|
|
"captureAppTypeWinGet",
|
|
"captureAppTypeMsi",
|
|
"captureAttemptNumber",
|
|
"captureDetectionResult",
|
|
"captureExitCodeClass"
|
|
]
|
|
},
|
|
"parameters": {
|
|
"type": "object",
|
|
"description": "Optional extra parameters for the action handler (all values are strings).",
|
|
"additionalProperties": { "type": "string" }
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"description": "Human-readable description of what this pattern detects and why."
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether this pattern is enabled. Set to false to add a pattern without activating it immediately.",
|
|
"default": true
|
|
}
|
|
},
|
|
"required": ["patternId", "category", "pattern", "action"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|