@@ -12,6 +12,10 @@ public class RegistryMonitor : BaseMonitor, IDisposable
12
12
{
13
13
public RegistryMonitor ( )
14
14
{
15
+ if ( RuntimeInformation . IsOSPlatform ( OSPlatform . Windows ) )
16
+ {
17
+ log = new ( "System" ) ;
18
+ }
15
19
}
16
20
17
21
public override bool CanRunOnPlatform ( )
@@ -43,15 +47,18 @@ public override void StartRun()
43
47
{
44
48
throw new PlatformNotSupportedException ( "ExecuteWindows is only supported on Windows platforms." ) ;
45
49
}
46
- // backup the current auditpolicy
47
- ExternalCommandRunner . RunExternalCommand ( "auditpol" , $ "/backup /file:{ tmpFileName } ") ;
50
+ if ( log is { } )
51
+ {
52
+ // backup the current auditpolicy
53
+ ExternalCommandRunner . RunExternalCommand ( "auditpol" , $ "/backup /file:{ tmpFileName } ") ;
48
54
49
- // start listening to the event log
50
- log . EntryWritten += new EntryWrittenEventHandler ( MyOnEntryWritten ) ;
51
- log . EnableRaisingEvents = true ;
55
+ // start listening to the event log
56
+ log . EntryWritten += new EntryWrittenEventHandler ( MyOnEntryWritten ) ;
57
+ log . EnableRaisingEvents = true ;
52
58
53
- // Enable auditing for registry events GUID for Registry subcategory of audit policy https://msdn.microsoft.com/en-us/library/dd973928.aspx
54
- ExternalCommandRunner . RunExternalCommand ( "auditpol" , "/set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030} /success:enable /failure:enable" ) ;
59
+ // Enable auditing for registry events GUID for Registry subcategory of audit policy https://msdn.microsoft.com/en-us/library/dd973928.aspx
60
+ ExternalCommandRunner . RunExternalCommand ( "auditpol" , "/set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030} /success:enable /failure:enable" ) ;
61
+ }
55
62
}
56
63
57
64
public override void StopRun ( )
@@ -60,24 +67,30 @@ public override void StopRun()
60
67
{
61
68
throw new PlatformNotSupportedException ( "ExecuteWindows is only supported on Windows platforms." ) ;
62
69
}
63
- // restore the old auditpolicy
64
- ExternalCommandRunner . RunExternalCommand ( "auditpol" , $ "/restore /file:{ tmpFileName } ") ;
70
+ if ( log is { } )
71
+ {
72
+ // restore the old auditpolicy
73
+ ExternalCommandRunner . RunExternalCommand ( "auditpol" , $ "/restore /file:{ tmpFileName } ") ;
65
74
66
- //delete temporary file
67
- ExternalCommandRunner . RunExternalCommand ( "del" , tmpFileName ) ;
75
+ //delete temporary file
76
+ ExternalCommandRunner . RunExternalCommand ( "del" , tmpFileName ) ;
68
77
69
- log . EnableRaisingEvents = false ;
78
+ log . EnableRaisingEvents = false ;
79
+ }
70
80
}
71
81
72
82
protected virtual void Dispose ( bool disposing )
73
83
{
74
84
if ( disposing )
75
85
{
76
- log . Dispose ( ) ;
86
+ if ( log is { } )
87
+ {
88
+ log . Dispose ( ) ;
89
+ }
77
90
}
78
91
}
79
92
80
- private readonly EventLog log = new ( "System" ) ;
93
+ private readonly EventLog ? log ;
81
94
82
95
private readonly string tmpFileName = Path . GetTempFileName ( ) ;
83
96
}
0 commit comments