cmtrace-open 1.5.0

Free, open-source CMTrace replacement: Windows log viewer with ConfigMgr/SCCM, Intune, and Autopilot ESP diagnostics, DSRegCmd triage, and real-time tailing.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

//! Windows process snapshots backed by a fixed, read-only WMI query.

use std::time::Duration;

use super::{ProcessProvider, ProcessReadError, ProcessSnapshotBatch, RawProcessSnapshot};
use crate::esp::system::{query_wmi, SystemReadError, WmiRequest};

pub struct LiveProcessProvider;

impl ProcessProvider for LiveProcessProvider {
    fn snapshot(
        &self,
        allowed_image_names: &[String],
        timeout: Duration,
        max_records: usize,
    ) -> ProcessSnapshotBatch {
        let batch = query_wmi(
            WmiRequest::Processes(allowed_image_names.to_vec()),
            timeout,
            max_records,
        );
        let snapshots = batch
            .rows
            .into_iter()
            .filter_map(|row| {
                let pid = row.get("ProcessId")?.parse().ok()?;
                let image_name = row.get("Name")?.trim();
                let start_time_utc = row.get("CreationDate")?.trim();
                if image_name.is_empty() || start_time_utc.is_empty() {
                    return None;
                }
                let parent_pid = row
                    .get("ParentProcessId")
                    .and_then(|value| value.parse::<u32>().ok())
                    .filter(|pid| *pid != 0);
                let command_line = row
                    .get("CommandLine")
                    .map(str::trim)
                    .filter(|value| !value.is_empty())
                    .map(str::to_string);
                Some(RawProcessSnapshot {
                    pid,
                    parent_pid,
                    image_name: image_name.to_string(),
                    start_time_utc: start_time_utc.to_string(),
                    command_line,
                })
            })
            .take(max_records)
            .collect();
        ProcessSnapshotBatch {
            snapshots,
            completion: batch.completion.map_err(map_system_error),
        }
    }
}

fn map_system_error(error: SystemReadError) -> ProcessReadError {
    match error {
        SystemReadError::Missing => ProcessReadError::Missing,
        SystemReadError::PermissionDenied => ProcessReadError::PermissionDenied,
        SystemReadError::TimedOut => ProcessReadError::TimedOut,
        SystemReadError::Failed(detail) => ProcessReadError::Failed(detail),
        SystemReadError::Unsupported => ProcessReadError::Unsupported,
    }
}