PTah
550cea9759
Persist RD Gateway poll cursor to avoid replaying 302/303 on monitor restart; treat ErrorCode 1226 as normal disconnect; pass event TimeCreated to SAC ingest. Co-authored-by: Cursor <cursoragent@cursor.com>
56 lines
2.0 KiB
PowerShell
56 lines
2.0 KiB
PowerShell
# Проверка парсинга UserData/EventInfo для RD Gateway 303 (BytesReceived != ErrorCode).
|
|
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
$sample303 = @'
|
|
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
|
<System>
|
|
<Provider Name="Microsoft-Windows-TerminalServices-Gateway" />
|
|
<EventID>303</EventID>
|
|
<TimeCreated SystemTime="2026-06-02T23:51:21.033855700Z" />
|
|
</System>
|
|
<UserData>
|
|
<EventInfo xmlns="aag">
|
|
<Username>B26\TSA</Username>
|
|
<IpAddress>95.154.72.73</IpAddress>
|
|
<Resource>192.168.164.43</Resource>
|
|
<BytesReceived>1991</BytesReceived>
|
|
<BytesTransfered>2116</BytesTransfered>
|
|
<SessionDuration>0</SessionDuration>
|
|
<ConnectionProtocol>HTTP</ConnectionProtocol>
|
|
<ErrorCode>1226</ErrorCode>
|
|
</EventInfo>
|
|
</UserData>
|
|
</Event>
|
|
'@
|
|
|
|
function Get-RDGatewayUserDataEventInfoMapFromXmlText {
|
|
param([string]$XmlText)
|
|
$map = @{}
|
|
$xml = [xml]$XmlText
|
|
$eventInfo = $xml.Event.UserData.EventInfo
|
|
foreach ($node in @($eventInfo.ChildNodes)) {
|
|
if ($null -eq $node -or $node.NodeType -ne [System.Xml.XmlNodeType]::Element) { continue }
|
|
$map[$node.LocalName] = [string]$node.InnerText
|
|
}
|
|
return $map
|
|
}
|
|
|
|
$map = Get-RDGatewayUserDataEventInfoMapFromXmlText -XmlText $sample303
|
|
if ($map['ErrorCode'] -ne '1226') {
|
|
throw "Expected ErrorCode=1226, got $($map['ErrorCode'])"
|
|
}
|
|
if ($map['BytesReceived'] -ne '1991') {
|
|
throw "Expected BytesReceived=1991, got $($map['BytesReceived'])"
|
|
}
|
|
if ($map['SessionDuration'] -ne '0') {
|
|
throw "Expected SessionDuration=0, got $($map['SessionDuration'])"
|
|
}
|
|
Write-Host 'OK: RD Gateway EventInfo XML fields parsed correctly (ErrorCode != BytesReceived).'
|
|
|
|
# 1226 в sample — типичный штатный код закрытия туннеля (в Login_Monitor.ps1 → disconnected, не failed).
|
|
if ($map['ErrorCode'] -ne '1226') {
|
|
throw 'Expected sample ErrorCode 1226 for standard RDG disconnect'
|
|
}
|
|
Write-Host 'OK: sample 303 ErrorCode 1226 (standard RD Gateway disconnect).'
|