@@ -12,6 +12,10 @@ public class RegistryMonitor : BaseMonitor, IDisposable
1212 {
1313 public RegistryMonitor ( )
1414 {
15+ if ( RuntimeInformation . IsOSPlatform ( OSPlatform . Windows ) )
16+ {
17+ log = new ( "System" ) ;
18+ }
1519 }
1620
1721 public override bool CanRunOnPlatform ( )
@@ -43,15 +47,18 @@ public override void StartRun()
4347 {
4448 throw new PlatformNotSupportedException ( "ExecuteWindows is only supported on Windows platforms." ) ;
4549 }
46- // backup the current auditpolicy
47- ExternalCommandRunner . RunExternalCommand ( "auditpol" , $ "/backup /file:{ tmpFileName } ") ;
50+ if ( log is { } )
51+ {
52+ // backup the current auditpolicy
53+ ExternalCommandRunner . RunExternalCommand ( "auditpol" , $ "/backup /file:{ tmpFileName } ") ;
4854
49- // start listening to the event log
50- log . EntryWritten += new EntryWrittenEventHandler ( MyOnEntryWritten ) ;
51- log . EnableRaisingEvents = true ;
55+ // start listening to the event log
56+ log . EntryWritten += new EntryWrittenEventHandler ( MyOnEntryWritten ) ;
57+ log . EnableRaisingEvents = true ;
5258
53- // Enable auditing for registry events GUID for Registry subcategory of audit policy https://msdn.microsoft.com/en-us/library/dd973928.aspx
54- ExternalCommandRunner . RunExternalCommand ( "auditpol" , "/set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030} /success:enable /failure:enable" ) ;
59+ // Enable auditing for registry events GUID for Registry subcategory of audit policy https://msdn.microsoft.com/en-us/library/dd973928.aspx
60+ ExternalCommandRunner . RunExternalCommand ( "auditpol" , "/set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030} /success:enable /failure:enable" ) ;
61+ }
5562 }
5663
5764 public override void StopRun ( )
@@ -60,24 +67,30 @@ public override void StopRun()
6067 {
6168 throw new PlatformNotSupportedException ( "ExecuteWindows is only supported on Windows platforms." ) ;
6269 }
63- // restore the old auditpolicy
64- ExternalCommandRunner . RunExternalCommand ( "auditpol" , $ "/restore /file:{ tmpFileName } ") ;
70+ if ( log is { } )
71+ {
72+ // restore the old auditpolicy
73+ ExternalCommandRunner . RunExternalCommand ( "auditpol" , $ "/restore /file:{ tmpFileName } ") ;
6574
66- //delete temporary file
67- ExternalCommandRunner . RunExternalCommand ( "del" , tmpFileName ) ;
75+ //delete temporary file
76+ ExternalCommandRunner . RunExternalCommand ( "del" , tmpFileName ) ;
6877
69- log . EnableRaisingEvents = false ;
78+ log . EnableRaisingEvents = false ;
79+ }
7080 }
7181
7282 protected virtual void Dispose ( bool disposing )
7383 {
7484 if ( disposing )
7585 {
76- log . Dispose ( ) ;
86+ if ( log is { } )
87+ {
88+ log . Dispose ( ) ;
89+ }
7790 }
7891 }
7992
80- private readonly EventLog log = new ( "System" ) ;
93+ private readonly EventLog ? log ;
8194
8295 private readonly string tmpFileName = Path . GetTempFileName ( ) ;
8396 }
0 commit comments