Added additional fall backs on event description formatting to resolv…

…e more events
microsoft · May 13, 2024 · 9ab800e · 9ab800e
1 parent b7d2936
commit 9ab800e
Showing 1 changed file with 11 additions and 4 deletions.
diff --git a/src/EventLogExpert.Eventing/EventResolvers/EventResolverBase.cs b/src/EventLogExpert.Eventing/EventResolvers/EventResolverBase.cs
@@ -62,9 +62,9 @@ protected EventResolverBase(Action<string, LogLevel> tracer)
 
     protected static IEnumerable<string> GetKeywordsFromBitmask(long? bitmask, ProviderDetails? providerDetails)
     {
-        if (bitmask is null or 0) { return Enumerable.Empty<string>(); }
+        if (bitmask is null or 0) { return []; }
 
-        var returnValue = new List<string>();
+        List<string> returnValue = [];
 
         foreach (var k in StandardKeywords.Keys)
         {
@@ -94,7 +94,12 @@ protected static IEnumerable<string> GetKeywordsFromBitmask(long? bitmask, Provi
         string? descriptionTemplate,
         List<MessageModel> parameters)
     {
-        if (descriptionTemplate == null) { return null; }
+        if (string.IsNullOrWhiteSpace(descriptionTemplate))
+        {
+            // Some events don't have a template but have event details in the properties
+            // Found a few providers that have their properties wrapped with \r\n for some reason
+            return properties.Count == 1 ? properties[0].Trim(['\r', '\n']) : null;
+        }
 
         string description = descriptionTemplate
             .Replace("\r\n%n", " \r\n")
@@ -250,6 +255,8 @@ protected DisplayEventModel ResolveFromProviderDetails(
         {
             var properties = GetFormattedProperties(null, eventProperties);
             description = FormatDescription(properties, providerDetails.Messages.FirstOrDefault(m => m.ShortId == eventRecord.Id)?.Text, providerDetails.Parameters);
+
+            description ??= "Unable to resolve description, see XML for more details.";
         }
 
         if (taskName == null && eventRecord.Task.HasValue)
@@ -290,7 +297,7 @@ protected DisplayEventModel ResolveFromProviderDetails(
             Severity.GetString(eventRecord.Level),
             eventRecord.ProviderName,
             taskName?.TrimEnd('\0') ?? string.Empty,
-            description?.TrimEnd('\0') ?? "Unable to format description",
+            description.TrimEnd('\0'),
             eventRecord.Qualifiers,
             GetKeywordsFromBitmask(eventRecord.Keywords, providerDetails),
             eventRecord.ProcessId,