in_etw: Implement event tracing for windows input plugin

[cosmo0920]

Description

This is a parity plugin of in_ebpf which is targeted for Windows platforms.
This is because there's no plugins to retrieve system level of traces on Windows platforms.
Windows platforms have Event Tracing for Windows component to provide system level tracing that is a similar mechanism of tracing Kernel side of events which are a part of capabilities of Linux's eBPF.
This is somewhat useful to diagnose system level of traces.

Add Windows ETW system logger support to event_tracing_windows.

This extends the input into two explicit modes:

• session_type provider: existing real-time ETW provider consumer path using
  provider_name or provider_guid.
• session_type system: Windows kernel/system logger path using kernel_flags,
  the SystemTraceControlGuid value, and EVENT_TRACE_SYSTEM_LOGGER_MODE.

This is ETW-based collection, not Windows Event Log channel collection. The
correct positioning is:

Event Tracing for Windows real-time provider and system/kernel logger consumer.

Behavior

System mode:

[INPUT]
    Name event_tracing_windows
    session_type system
    kernel_flags process,thread,image_load

uses the Windows kernel logger session:

NT Kernel Logger

and configures the session through EVENT_TRACE_PROPERTIES with:

props->Wnode.Guid = SystemTraceControlGuid;
props->LogFileMode = EVENT_TRACE_REAL_TIME_MODE |
                     EVENT_TRACE_SYSTEM_LOGGER_MODE;
props->EnableFlags = ctx->kernel_flags;

EnableTraceEx2() is skipped in system mode because kernel logger events are
enabled by session flags, not by enabling one provider GUID.

Provider-specific options are rejected in system mode:

provider_name
provider_guid

because system mode consumes multiple kernel providers rather than one
configured provider.

Validation

Build:

cmd.exe /s /c '"C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\VsDevCmd.bat" -arch=x64 && cmake --build build --target fluent-bit-bin'

Confirm config map exposes the new options:

build\bin\fluent-bit.exe -i event_tracing_windows -h

Confirm invalid system session names are rejected early:

build\bin\fluent-bit.exe -i event_tracing_windows `
  -p session_type=system `
  -p session_name=foo `
  -p kernel_flags=process,thread,image_load `
  -o stdout -f 1 -vv

Expected result:

session_type system requires session_name 'NT Kernel Logger'
[engine] input initialization failed

Confirm non-elevated behavior:

build\bin\fluent-bit.exe -i event_tracing_windows `
  -p session_type=system `
  -p kernel_flags=process,thread,image_load `
  -o stdout -f 1 -vv

Expected result from a non-Administrator shell:

StartTrace failed for session 'NT Kernel Logger' (status=5)
[engine] input initialization failed

Confirm elevated kernel collection from an Administrator shell:

build\bin\fluent-bit.exe -i event_tracing_windows `
  -p session_type=system `
  -p kernel_flags=process,thread,image_load,cswitch,tcpip,disk_io `
  -o stdout -f 1 -vv

Expected result:

The input starts successfully and emits records from the Windows kernel logger:

[event_tracing_windows.0] provider_guid="{...}"
[event_tracing_windows.0] provider_name=nil
[event_tracing_windows.0] event_id=0
[event_tracing_windows.0] opcode=...
[event_tracing_windows.0] payload={...}

Example observed output:

provider_guid="{68fdd900-4a3e-11d1-84f4-0000f80464e3}"
provider_name=nil
event_id=0
version=2
opcode=32
payload.GroupMask1=0
payload.KernelEventVersion=85

Image-load events may appear when matching activity occurs, for example:

provider_guid="{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}"
payload.FileName="..."
payload.ProcessId=...

Image-load payloads are not required as the only success condition; kernel
logger output depends on the enabled flags and runtime activity during the test
window.

Compatibility Notes

Provider mode remains the default:

session_type provider

Existing configurations using provider_name or provider_guid continue to use
the normal real-time provider consumer path.

Both modes require Administrator privileges on Windows because the plugin starts
and controls ETW real-time trace sessions:

session_type provider
session_type system

System mode is additionally constrained to the Windows kernel logger session
name:

NT Kernel Logger

A non-elevated shell can fail with:

StartTrace failed for session '<session name>' (status=5)

where status=5 is ERROR_ACCESS_DENIED.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• New Features
  • Added support for a new Windows Event Tracing input plugin.
  • Windows builds now enable this input by default, while keeping it configurable.
  • The plugin includes session management, event collection, and runtime metrics for lost events.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 116a98f5-9b7a-475e-a26e-18e861d4aab9

📥 Commits

Reviewing files that changed from the base of the PR and between 18a871c and ad8ce10.

📒 Files selected for processing (2)

• plugins/in_etw/etw.c
• plugins/in_etw/etw.h

🚧 Files skipped from review as they are similar to previous changes (2)

• plugins/in_etw/etw.h
• plugins/in_etw/etw.c

---

📝 Walkthrough

Walkthrough

This PR adds a new Windows ETW input plugin, in_etw, with CMake wiring, plugin registration, runtime state definitions, ETW session management, event serialization, and lifecycle callbacks.

Changes

ETW input plugin

Layer / File(s)	Summary
Build system wiring for in_etw plugin cmake/plugins_options.cmake, cmake/windows-setup.cmake, plugins/CMakeLists.txt, plugins/in_etw/CMakeLists.txt	Adds the FLB_IN_ETW CMake option, enables it by default on Windows, registers in_etw, and defines its build rules and link dependencies.
Plugin context and configuration constants plugins/in_etw/etw.h	Defines default ETW configuration macros, session and stale-action constants, and the struct flb_etw runtime state container.
Config parsing and event packing helpers plugins/in_etw/etw.c	Implements GUID and integer parsing, session and kernel-flag parsing, UTF-8 and UTF-16 conversion, provider GUID resolution, trace-property setup, ETW time conversion, and TDH value packing.
Event serialization and callback plugins/in_etw/etw.c	Enumerates TDH properties, extracts related activity IDs, builds MessagePack event records, and appends them through the ETW event callback.
Session lifecycle and worker thread plugins/in_etw/etw.c	Implements trace/session start and stop, stale-session retry handling, provider enablement, ProcessTrace execution, startup synchronization, pause and exit behavior, and context teardown.
Initialization, config map, and plugin export plugins/in_etw/etw.c	Validates configuration, sets up loss-metrics gauges and collector scheduling, allocates and initializes the plugin context, defines the config_map, and exports in_etw_plugin with its callbacks.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
    participant FluentBitCore as Fluent Bit Core
    participant InEtwPlugin as in_etw plugin
    participant WorkerThread as ETW worker thread
    participant ETWSession as Windows ETW session
    participant TDH as TDH API

    FluentBitCore->>InEtwPlugin: in_etw_init()
    InEtwPlugin->>InEtwPlugin: validate config and build session state
    InEtwPlugin->>WorkerThread: start worker thread
    WorkerThread->>ETWSession: StartTraceW / EnableTraceEx2 / OpenTraceW
    WorkerThread->>ETWSession: ProcessTrace()
    ETWSession-->>WorkerThread: ETW event callback
    WorkerThread->>TDH: TdhGetEventInformation / TdhGetProperty
    TDH-->>WorkerThread: property values
    WorkerThread->>FluentBitCore: flb_input_log_append(record)
    WorkerThread->>ETWSession: ControlTraceW(query loss metrics)
    WorkerThread->>FluentBitCore: update ETW loss gauges
    FluentBitCore->>InEtwPlugin: in_etw_pause / in_etw_resume / in_etw_exit
    InEtwPlugin->>WorkerThread: stop or restart trace processing
    InEtwPlugin->>ETWSession: close session and trace handles

Loading

Suggested reviewers: edsiper, fujimotos

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding the Windows ETW input plugin.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cosmo0920-implement-event-tracing-for-windows

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 846e9dd510

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[edsiper]

Is this similar to https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/windowseventlogreceiver ? (per my read of this PR it seems it ships the signal as a log, should we use ctraces ? -- open for discussion)