Files
AWatch-rus/windows/worktime-session-collector.ps1
T

575 lines
20 KiB
PowerShell

param(
[string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
[string]$Hostname,
[int]$PollSeconds = 0
)
# Force UTF-8 for console I/O
try { [Console]::OutputEncoding = [System.Text.Encoding]::UTF8 } catch {}
try { [Console]::InputEncoding = [System.Text.Encoding]::UTF8 } catch {}
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Continue'
function Decode-Bytes-Auto {
param([byte[]]$Bytes)
if (-not $Bytes) { return '' }
$candidates = @()
# Try strict UTF8 first (detect invalid sequences)
try {
$utf8Strict = New-Object System.Text.UTF8Encoding($false,$true)
$txt = $utf8Strict.GetString($Bytes)
$candidates += @{enc='utf8'; text=$txt}
}
catch {
# invalid UTF8 sequences; ignore
}
# Try CP866 and CP1251
try { $cp866 = [System.Text.Encoding]::GetEncoding(866); $txt866 = $cp866.GetString($Bytes); $candidates += @{enc='cp866'; text=$txt866} } catch {}
try { $cp1251 = [System.Text.Encoding]::GetEncoding(1251); $txt1251 = $cp1251.GetString($Bytes); $candidates += @{enc='cp1251'; text=$txt1251} } catch {}
# If nothing decoded yet, fallback to UTF8 permissive
if ($candidates.Count -eq 0) {
try { $txt = [System.Text.Encoding]::UTF8.GetString($Bytes); return $txt } catch { return '' }
}
# Score decodings by count of Cyrillic letters; prefer highest
$best = $null; $bestScore = -1
foreach ($c in $candidates) {
$t = $c.text
if (-not $t) { continue }
$score = 0
try { $score = ([regex]::Matches($t,'\p{IsCyrillic}')).Count } catch { $score = 0 }
if ($score -gt $bestScore) { $best = $c; $bestScore = $score }
}
if ($best -ne $null) { return $best.text }
# Final fallback: first candidate text
return $candidates[0].text
}
function Get-Config {
param([string]$Path)
if (-not (Test-Path -LiteralPath $Path)) {
throw "Config not found: $Path"
}
try {
$bytes = [System.IO.File]::ReadAllBytes($Path)
# Config is JSON. Prefer deterministic BOM-based decoding over heuristics.
if ($bytes.Length -ge 3 -and $bytes[0] -eq 0xEF -and $bytes[1] -eq 0xBB -and $bytes[2] -eq 0xBF) {
$text = [System.Text.Encoding]::UTF8.GetString($bytes)
} elseif ($bytes.Length -ge 2 -and $bytes[0] -eq 0xFF -and $bytes[1] -eq 0xFE) {
$text = [System.Text.Encoding]::Unicode.GetString($bytes)
} else {
$text = [System.Text.Encoding]::UTF8.GetString($bytes)
}
$text = $text -replace '^\uFEFF', ''
return $text | ConvertFrom-Json -ErrorAction Stop
}
catch {
throw "Failed to read config: $Path - $($_.Exception.Message)"
}
}
function Invoke-AwJsonPost {
param(
[Parameter(Mandatory = $true)][string]$Uri,
[Parameter(Mandatory = $true)][string]$Json
)
try {
$bytes = [System.Text.Encoding]::UTF8.GetBytes($Json)
Invoke-RestMethod -Method Post -Uri $Uri -ContentType 'application/json; charset=utf-8' -Body $bytes -ErrorAction Stop | Out-Null
return $true
}
catch {
Write-Verbose "POST error: $($_.Exception.Message)"
return $false
}
}
function Ensure-Bucket {
param(
[Parameter(Mandatory = $true)][string]$ApiBase,
[Parameter(Mandatory = $true)][string]$BucketId,
[Parameter(Mandatory = $true)][string]$HostnameValue,
[string]$ClientName = 'aw-worktime-session-collector',
[string]$BucketType = 'aw.worktime.session'
)
try { Invoke-RestMethod -Method Get -Uri "$ApiBase/buckets/$BucketId" -ErrorAction Stop | Out-Null; return } catch { Write-Verbose "Bucket not found, creating: $BucketId" }
$body = @{ client=$ClientName; type=$BucketType; hostname=$HostnameValue } | ConvertTo-Json -Compress
$attempts = 0
while ($attempts -lt 3) {
$attempts++
$ok = Invoke-AwJsonPost -Uri "$ApiBase/buckets/$BucketId" -Json $body
if ($ok) { return }
Start-Sleep -Seconds (2 * $attempts)
}
try { Invoke-RestMethod -Method Get -Uri "$ApiBase/buckets/$BucketId" -ErrorAction Stop | Out-Null } catch { Write-Verbose "Ensure-Bucket final check failed: $BucketId" }
}
function Run-QueryUser {
$tries = @(
@{File='cmd.exe';Args='/c query user'},
@{File='cmd.exe';Args='/c quser'},
@{File='query.exe';Args='user'},
@{File='quser.exe';Args=''}
)
foreach ($t in $tries) {
try {
$psi = New-Object System.Diagnostics.ProcessStartInfo
$psi.FileName = $t.File
if ($t.Args) { $psi.Arguments = $t.Args }
$psi.RedirectStandardOutput = $true
$psi.RedirectStandardError = $true
$psi.UseShellExecute = $false
$psi.CreateNoWindow = $true
$proc = [System.Diagnostics.Process]::Start($psi)
$stream = $proc.StandardOutput.BaseStream
$ms = New-Object System.IO.MemoryStream
$buffer = New-Object byte[] 4096
while (($read = $stream.Read($buffer,0,$buffer.Length)) -gt 0) { $ms.Write($buffer,0,$read) }
if (-not $proc.WaitForExit(8000)) {
try { $proc.Kill() } catch {}
continue
}
$bytes = $ms.ToArray()
$text = Decode-Bytes-Auto -Bytes $bytes
if ($text -and $text.Trim()) { return ($text -split "\r?\n") | Where-Object { $_ -ne '' } }
}
catch {
# try next
}
}
return @()
}
function Parse-SessionLines {
param([string[]]$Lines)
$records = @()
if (-not $Lines) { return $records }
$startIndex = 0
# NOTE: Keep this script ASCII-only to stay compatible with Windows PowerShell 5
# when the file is UTF-8 without BOM. Avoid Cyrillic literals in regex patterns.
if ($Lines.Count -gt 0 -and $Lines[0] -match '\b(USERNAME|UserName|USER)\b') { $startIndex = 1 }
for ($i = $startIndex; $i -lt $Lines.Count; $i++) {
$line = ($Lines[$i] -replace '^\s*>', '').Trim()
if (-not $line) { continue }
$parts = $line -split '\s+'
if ($parts.Count -lt 3) { continue }
$user = $parts[0]
$sess = ''
$id = -1
$state = ''
if ($parts.Count -ge 4 -and $parts[1] -match '^\d+$') {
$sess = ''
$id = [int]$parts[1]
$state = [string]$parts[2]
}
elseif ($parts.Count -ge 4 -and $parts[2] -match '^\d+$') {
$sess = [string]$parts[1]
$id = [int]$parts[2]
$state = [string]$parts[3]
}
else {
continue
}
if ($id -lt 0) { continue }
$records += [pscustomobject]@{ username=$user; sessionName=$sess; sessionId=$id; state=$state }
}
return $records
}
function Test-SessionIsActive {
param([string]$State)
if (-not $State) { return $false }
$s = $State.Trim().ToLowerInvariant()
# Match English "active" and Russian "актив*" without embedding Cyrillic.
# "актив" = \u0430\u043A\u0442\u0438\u0432
return ($s -match 'active') -or ($s -match '\u0430\u043a\u0442\u0438\u0432')
}
function Get-CanonicalUserId {
param(
[pscustomobject]$Config,
[string]$HostnameValue,
[string]$Username
)
$normalizedUser = [string]$Username
if ([string]::IsNullOrWhiteSpace($normalizedUser)) {
return ''
}
if ($Config -and $Config.PSObject.Properties.Name -contains 'userTasks' -and $Config.userTasks) {
foreach ($task in @($Config.userTasks)) {
try {
$taskUserId = [string]$task.userId
if ([string]::IsNullOrWhiteSpace($taskUserId)) {
continue
}
$parts = $taskUserId -split '\\', 2
if ($parts.Count -eq 2 -and $parts[1].Equals($normalizedUser, [System.StringComparison]::OrdinalIgnoreCase)) {
return $taskUserId
}
}
catch {
}
}
}
return "$HostnameValue\$normalizedUser"
}
function Get-SessionEventsBucketId {
param(
[pscustomobject]$Config,
[string]$HostnameValue
)
$prefix = 'aw-session-events'
if (
$Config -and
$Config.PSObject.Properties.Name -contains 'sessionEvents' -and
$Config.sessionEvents -and
$Config.sessionEvents.PSObject.Properties.Name -contains 'bucketPrefix' -and
-not [string]::IsNullOrWhiteSpace([string]$Config.sessionEvents.bucketPrefix)
) {
$prefix = [string]$Config.sessionEvents.bucketPrefix
}
return ('{0}_{1}' -f $prefix, $HostnameValue)
}
function Test-SessionProcessEventsEnabled {
param([pscustomobject]$Config)
if (
$Config -and
$Config.PSObject.Properties.Name -contains 'sessionEvents' -and
$Config.sessionEvents -and
$Config.sessionEvents.PSObject.Properties.Name -contains 'processEventsEnabled'
) {
return [bool]$Config.sessionEvents.processEventsEnabled
}
return $true
}
function Get-ProcessStatePath {
param([pscustomobject]$Config)
$stateRoot = ''
if ($Config -and $Config.PSObject.Properties.Name -contains 'paths' -and $Config.paths) {
if ($Config.paths.PSObject.Properties.Name -contains 'stateRoot') {
$stateRoot = [string]$Config.paths.stateRoot
}
}
if ([string]::IsNullOrWhiteSpace($stateRoot)) {
$stateRoot = 'C:\ProgramData\AWatch-rus'
}
return (Join-Path $stateRoot 'session-process-state.json')
}
function Load-ProcessState {
param([string]$Path)
$map = @{}
try {
if (Test-Path -LiteralPath $Path) {
$raw = Get-Content -LiteralPath $Path -Raw -ErrorAction Stop
if (-not [string]::IsNullOrWhiteSpace($raw)) {
$obj = $raw | ConvertFrom-Json -ErrorAction Stop
foreach ($item in @($obj.processes)) {
if (-not $item) { continue }
$key = [string]$item.key
if ([string]::IsNullOrWhiteSpace($key)) { continue }
$map[$key] = $item
}
}
}
}
catch {
Write-Verbose "Process state load error: $($_.Exception.Message)"
}
return $map
}
function Save-ProcessState {
param(
[string]$Path,
[hashtable]$Map
)
try {
$dir = Split-Path -Path $Path -Parent
if ($dir -and -not (Test-Path -LiteralPath $dir)) {
New-Item -Path $dir -ItemType Directory -Force | Out-Null
}
$items = @()
foreach ($entry in $Map.GetEnumerator()) {
$value = $entry.Value
if ($null -eq $value) { continue }
$items += [pscustomobject]@{
key = [string]$entry.Key
processId = [int]$value.processId
sessionId = [int]$value.sessionId
username = [string]$value.username
userId = [string]$value.userId
state = [string]$value.state
processName = [string]$value.processName
commandLine = [string]$value.commandLine
createdAt = [string]$value.createdAt
hostname = [string]$value.hostname
}
}
$payload = [pscustomobject]@{ processes = $items }
$payload | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $Path -Encoding UTF8
}
catch {
Write-Verbose "Process state save error: $($_.Exception.Message)"
}
}
function Test-ExcludedSessionProcess {
param(
[string]$Name,
[string]$CommandLine
)
$n = [string]$Name
if ([string]::IsNullOrWhiteSpace($n)) { return $true }
if ($n -match '^(Idle|System|Registry|svchost|services|lsass|winlogon|csrss|fontdrvhost|dwm|taskhostw|sihost|explorer)\.exe$') { return $true }
if ($n -match '^(aw-watcher-afk|aw-watcher-window|conhost)\.exe$') { return $true }
return $false
}
function Get-SessionProcessSnapshot {
param(
[pscustomobject]$Config,
[string]$HostnameValue,
[object[]]$SessionRecords
)
$bySession = @{}
foreach ($rec in @($SessionRecords)) {
if ($null -eq $rec) { continue }
$sid = [int]$rec.sessionId
$bySession[$sid] = [pscustomobject]@{
username = [string]$rec.username
userId = Get-CanonicalUserId -Config $Config -HostnameValue $HostnameValue -Username ([string]$rec.username)
state = [string]$rec.state
}
}
$snapshot = @{}
if ($bySession.Count -eq 0) {
return $snapshot
}
try {
$procs = Get-Process -ErrorAction Stop | Where-Object { $bySession.ContainsKey([int]$_.SessionId) }
}
catch {
Write-Verbose "Process snapshot error: $($_.Exception.Message)"
return $snapshot
}
foreach ($proc in @($procs)) {
try {
$sid = [int]$proc.SessionId
}
catch {
continue
}
if (-not $bySession.ContainsKey($sid)) { continue }
$name = [string]$proc.ProcessName
if ($name -and $name -notmatch '\.exe$') {
$name = "$name.exe"
}
$commandLine = ''
if (Test-ExcludedSessionProcess -Name $name -CommandLine $commandLine) { continue }
$createdAt = ''
try {
if ($proc.StartTime) {
$createdAt = $proc.StartTime.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
}
}
catch {
$createdAt = ''
}
if ([string]::IsNullOrWhiteSpace($createdAt)) {
$createdAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
}
$key = ('{0}|{1}|{2}' -f $sid, [int]$proc.Id, $createdAt)
$sessionMeta = $bySession[$sid]
$snapshot[$key] = [pscustomobject]@{
processId = [int]$proc.Id
sessionId = $sid
username = [string]$sessionMeta.username
userId = [string]$sessionMeta.userId
state = [string]$sessionMeta.state
processName = $name
commandLine = $commandLine
createdAt = $createdAt
hostname = $HostnameValue
}
}
return $snapshot
}
function Publish-SessionProcessEvents {
param(
[string]$ApiBase,
[string]$BucketId,
[hashtable]$Previous,
[hashtable]$Current
)
foreach ($entry in $Current.GetEnumerator()) {
if ($Previous.ContainsKey($entry.Key)) { continue }
$item = $entry.Value
$payload = [pscustomobject]@{
timestamp = [string]$item.createdAt
duration = 0
data = [pscustomobject]@{
eventType = 'process_start'
username = [string]$item.username
userId = [string]$item.userId
sessionId = [int]$item.sessionId
state = [string]$item.state
processId = [int]$item.processId
processName = [string]$item.processName
commandLine = [string]$item.commandLine
createdAt = [string]$item.createdAt
hostname = [string]$item.hostname
source = 'worktime-session-collector'
}
} | ConvertTo-Json -Depth 6 -Compress
try {
[void](Invoke-AwJsonPost -Uri "$ApiBase/buckets/$BucketId/heartbeat?pulsetime=1" -Json $payload)
}
catch {
Write-Verbose "Process start publish error: $($_.Exception.Message)"
}
}
$nowUtc = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
foreach ($entry in $Previous.GetEnumerator()) {
if ($Current.ContainsKey($entry.Key)) { continue }
$item = $entry.Value
$payload = [pscustomobject]@{
timestamp = $nowUtc
duration = 0
data = [pscustomobject]@{
eventType = 'process_stop'
username = [string]$item.username
userId = [string]$item.userId
sessionId = [int]$item.sessionId
state = [string]$item.state
processId = [int]$item.processId
processName = [string]$item.processName
commandLine = [string]$item.commandLine
createdAt = [string]$item.createdAt
hostname = [string]$item.hostname
source = 'worktime-session-collector'
}
} | ConvertTo-Json -Depth 6 -Compress
try {
[void](Invoke-AwJsonPost -Uri "$ApiBase/buckets/$BucketId/heartbeat?pulsetime=1" -Json $payload)
}
catch {
Write-Verbose "Process stop publish error: $($_.Exception.Message)"
}
}
}
# Main
$cfg = Get-Config -Path $ConfigPath
$hostValue = if ($Hostname -and $Hostname.Trim()) { $Hostname.Trim() } elseif ($cfg -and $cfg.PSObject.Properties.Name -contains 'awHostname' -and -not [string]::IsNullOrWhiteSpace([string]$cfg.awHostname)) { [string]$cfg.awHostname } elseif ($cfg -and $cfg.awHostname) { [string]$cfg.awHostname } else { [string]$env:COMPUTERNAME }
try { $apiBase = '{0}://{1}:{2}/api/0' -f [string]$cfg.server.scheme, [string]$cfg.server.host, [string]$cfg.server.port } catch { throw 'Invalid server configuration in config file.' }
$bucketId = 'aw-worktime-sessions_' + $hostValue
$sessionEventsBucketId = Get-SessionEventsBucketId -Config $cfg -HostnameValue $hostValue
$processEventsEnabled = Test-SessionProcessEventsEnabled -Config $cfg
$processStatePath = Get-ProcessStatePath -Config $cfg
$sleepSec = if ($PollSeconds -gt 0) { $PollSeconds } elseif ($cfg.collector -and $cfg.collector.pollSeconds) { [int]$cfg.collector.pollSeconds } else { 30 }
$pulse = [Math]::Max($sleepSec * 3, 30)
Ensure-Bucket -ApiBase $apiBase -BucketId $bucketId -HostnameValue $hostValue
if ($processEventsEnabled) {
Ensure-Bucket -ApiBase $apiBase -BucketId $sessionEventsBucketId -HostnameValue $hostValue -ClientName 'aw-session-events' -BucketType 'aw.session.event'
$previousProcessState = Load-ProcessState -Path $processStatePath
}
else {
$previousProcessState = @{}
}
while ($true) {
$now = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
try {
$lines = Run-QueryUser
$records = Parse-SessionLines -Lines $lines
}
catch {
Write-Verbose "Session parse error: $($_.Exception.Message)"
$records = @()
}
if (-not $records -or $records.Count -eq 0) {
# Fallback sample: keep bucket alive even when query user output is unavailable
# in non-interactive/session-0 contexts.
$records = @(
[pscustomobject]@{
username = [string]$env:USERNAME
sessionName = ''
sessionId = [int](Get-Process -Id $PID).SessionId
state = 'Unknown'
}
)
}
if ($processEventsEnabled) {
$currentProcessState = Get-SessionProcessSnapshot -Config $cfg -HostnameValue $hostValue -SessionRecords $records
Publish-SessionProcessEvents -ApiBase $apiBase -BucketId $sessionEventsBucketId -Previous $previousProcessState -Current $currentProcessState
Save-ProcessState -Path $processStatePath -Map $currentProcessState
$previousProcessState = $currentProcessState
}
foreach ($rec in $records) {
$canonicalUserId = Get-CanonicalUserId -Config $cfg -HostnameValue $hostValue -Username ([string]$rec.username)
$payloadObj = [PSCustomObject]@{
timestamp = $now
duration = $sleepSec
data = [PSCustomObject]@{
username = [string]$rec.username
userId = $canonicalUserId
sessionId = [int]$rec.sessionId
sessionName = [string]$rec.sessionName
state = [string]$rec.state
active = Test-SessionIsActive -State ([string]$rec.state)
sampleSeconds = $sleepSec
pollSeconds = $sleepSec
hostname = $hostValue
source = 'worktime-session-collector'
}
}
$payload = $payloadObj | ConvertTo-Json -Depth 6 -Compress
try {
$ok = Invoke-AwJsonPost -Uri "$apiBase/buckets/$bucketId/heartbeat?pulsetime=$pulse" -Json $payload
if (-not $ok) { Write-Verbose "Heartbeat not confirmed for user $($rec.username)" }
}
catch {
Write-Verbose "Heartbeat error: $($_.Exception.Message)"
}
}
Start-Sleep -Seconds $sleepSec
}