Refactored resolver and added support for Locale Metadata folders

Author: jschick04

src/EventLogExpert.Eventing.Tests/EventResolvers/EventResolverBaseTests.cs

@@ -0,0 +1,44 @@
+// // Copyright (c) Microsoft Corporation.
+// // Licensed under the MIT License.
+
+using EventLogExpert.Eventing.Helpers;
+
+namespace EventLogExpert.Eventing.Tests.Helpers;
+
+public sealed class NativeMethodsTests
+{
+    [Theory]
+    [InlineData("%1 parameter", true)]
+    [InlineData("%9 parameter", true)]
+    [InlineData("error %1 occurred", true)]
+    [InlineData("code %10 detail", true)]
+    [InlineData("code %99 detail", true)]
+    [InlineData("%1!s! insert", true)]
+    [InlineData("value: %s", true)]
+    [InlineData("value: %S", true)]
+    [InlineData("count: %d", true)]
+    [InlineData("count: %i", true)]
+    [InlineData("count: %u", true)]
+    [InlineData("hex: %x", true)]
+    [InlineData("hex: %X", true)]
+    [InlineData("ptr: %p", true)]
+    [InlineData("char: %c", true)]
+    [InlineData("char: %C", true)]
+    [InlineData("octal: %o", true)]
+    [InlineData("float: %f", true)]
+    [InlineData("float: %F", true)]
+    [InlineData("sci: %e", true)]
+    [InlineData("sci: %E", true)]
+    [InlineData("gen: %g", true)]
+    [InlineData("gen: %G", true)]
+    [InlineData("100%% complete", false)]
+    [InlineData("clean message", false)]
+    [InlineData("100% done", false)]
+    [InlineData("value %0", false)]
+    [InlineData("trailing %", false)]
+    [InlineData("", false)]
+    [InlineData("%%s escaped", false)]
+    [InlineData("a %% b %% c", false)]
+    public void ContainsFormatInsert_DetectsExpectedPatterns(string input, bool expected) =>
+        Assert.Equal(expected, NativeMethods.ContainsFormatInsert(input));
+}

src/EventLogExpert.Eventing.Tests/Helpers/NativeMethodsTests.cs

@@ -492,8 +492,14 @@ public void TryGetEvents_WhenLargeLogWithManyReads_ShouldEventuallyReturnFalse()
         // Arrange
         using var reader = new EventLogReader(Constants.ApplicationLogName, PathType.LogName);
 
-        int maxIterations = 1000; // Safety limit
-        int iterations = 0;
+        var logInfo = new EventLogInformation(
+            EventLogSession.GlobalSession,
+            Constants.ApplicationLogName,
+            PathType.LogName);
+
+        // Derive iteration limit from actual log size (batch size defaults to 30)
+        long maxIterations = (logInfo.RecordCount ?? 0) / 30 + 100;
+        long iterations = 0;
 
         // Act
         bool success;

src/EventLogExpert.Eventing.Tests/Readers/EventLogReaderTests.cs

@@ -6,6 +6,7 @@
 using EventLogExpert.Eventing.Models;
 using EventLogExpert.Eventing.Providers;
 using Microsoft.EntityFrameworkCore;
+using System.Collections.Concurrent;
 using System.Collections.Immutable;
 using System.Text.RegularExpressions;
 
@@ -20,9 +21,11 @@ namespace EventLogExpert.Eventing.EventResolvers;
 public sealed partial class EventResolver : EventResolverBase, IEventResolver
 {
     private readonly Lock _databaseAccessLock = new();
+    private readonly ConcurrentDictionary<string, bool> _providerFromNonLocal = new(StringComparer.OrdinalIgnoreCase);
+    private readonly ConcurrentDictionary<string, ProviderDetails?> _supplementalDetails = new(StringComparer.OrdinalIgnoreCase);
 
     private ImmutableArray<EventProviderDbContext> _dbContexts = [];
-    private IReadOnlyList<string>? _metadataPaths;
+    private ImmutableArray<string> _metadataPaths = [];
 
     public EventResolver(
         IDatabaseCollectionProvider? dbCollection = null,
@@ -37,6 +40,13 @@ public EventResolver(
         Logger?.Debug($"{nameof(EventResolver)} was instantiated.");
     }
 
+    public override DisplayEventModel ResolveEvent(EventRecord eventRecord)
+    {
+        ResolveProviderDetails(eventRecord);
+
+        return base.ResolveEvent(eventRecord);
+    }
+
     public void ResolveProviderDetails(EventRecord eventRecord)
     {
         ObjectDisposedException.ThrowIf(IsDisposed, nameof(EventResolver));
@@ -49,7 +59,7 @@ public void ResolveProviderDetails(EventRecord eventRecord)
             if (ProviderDetails.ContainsKey(eventRecord.ProviderName)) { return; }
 
             // 1. Try MTA locale metadata files (primary source for exported logs)
-            if (_metadataPaths is { Count: > 0 } && TryResolveFromMta(eventRecord))
+            if (_metadataPaths.Length > 0 && TryResolveFromMta(eventRecord))
             {
                 return;
             }
@@ -65,11 +75,7 @@ public void ResolveProviderDetails(EventRecord eventRecord)
         }
     }
 
-    /// <summary>
-    ///     Sets the MTA locale metadata file paths for exported log resolution. Must be called before any events are
-    ///     resolved.
-    /// </summary>
-    public void SetMetadataPaths(IReadOnlyList<string> metadataPaths) => _metadataPaths = metadataPaths;
+    public void SetMetadataPaths(IReadOnlyList<string> metadataPaths) => _metadataPaths = [.. metadataPaths];
 
     /// <summary>
     ///     If the database file name ends in a year or a number, such as Exchange 2019 or Windows 2016, we want to sort
@@ -144,6 +150,21 @@ protected override void Dispose(bool disposing)
         base.Dispose(disposing);
     }
 
+    protected override ProviderDetails? TryGetSupplementalDetails(EventRecord eventRecord)
+    {
+        // Only supplement providers that were loaded from MTA/DB
+        if (!_providerFromNonLocal.ContainsKey(eventRecord.ProviderName)) { return null; }
+
+        return _supplementalDetails.GetOrAdd(
+            eventRecord.ProviderName,
+            name =>
+            {
+                Logger?.Debug($"Loading supplemental local provider for {name}");
+
+                return new EventMessageProvider(name, Logger).LoadProviderDetails();
+            });
+    }
+
     [GeneratedRegex("^(.+) (\\S+)$")]
     private static partial Regex SplitProductAndVersionRegex();
 
@@ -228,6 +249,7 @@ private bool TryResolveFromDatabase(EventRecord eventRecord)
 
                 Logger?.Debug($"Resolved {eventRecord.ProviderName} from database {dbContext.Name}.");
                 ProviderDetails.TryAdd(eventRecord.ProviderName, details);
+                _providerFromNonLocal.TryAdd(eventRecord.ProviderName, true);
 
                 return true;
             }
@@ -244,12 +266,13 @@ private bool TryResolveFromMta(EventRecord eventRecord)
             _metadataPaths,
             Logger).LoadProviderDetails();
 
-        if (details.Events.Count == 0 && details.Keywords.Count == 0)
+        if (details.Events.Count == 0 && details.Keywords.Count == 0 && details.Messages.Count == 0)
         {
             return false;
         }
 
         ProviderDetails.TryAdd(eventRecord.ProviderName, details);
+        _providerFromNonLocal.TryAdd(eventRecord.ProviderName, true);
 
         return true;
     }