Adding support for WCOW UVM log forward service #2524
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
@microsoft-github-policy-service agree company="Microsoft" |
marma-dev
force-pushed
the
main
branch
3 times, most recently
from
a0a0dcd to
e4214fd
Compare
rawahars
requested changes
Sep 23, 2025
Signed-off-by: Manish Ranjan Mahanta <mmahanta@microsoft.com>
helsaawy
requested changes
Oct 15, 2025
Comment on lines
+184
to
+187
| MsgTypeRequest MsgType = 0x10000000 | ||
| MsgTypeResponse MsgType = 0x20000000 | ||
| MsgTypeNotify MsgType = 0x30000000 | ||
| MsgTypeMask MsgType = 0xf0000000 |
Comment on lines
+16
to
+31
| if uvm.OS() == "windows" && uvm.gc != nil { | ||
| wcaps := gcs.GetWCOWCapabilities(uvm.gc.Capabilities()) | ||
| if wcaps != nil && wcaps.IsLogForwardingSupported() { | ||
| req := guestrequest.LogForwardServiceRPCRequest{ | ||
| RPCType: guestrequest.RPCStartLogForwarding, | ||
| Settings: "", | ||
| } | ||
| err := uvm.gc.ModifyServiceSettings(ctx, prot.LogForwardService, req) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| } else { | ||
| log.G(ctx).WithField("os", uvm.operatingSystem).Error("Log forwarding not supported for this OS") | ||
| } | ||
| } | ||
| return nil |
There was a problem hiding this comment.
Suggested change
| if uvm.OS() == "windows" && uvm.gc != nil { | |
| wcaps := gcs.GetWCOWCapabilities(uvm.gc.Capabilities()) | |
| if wcaps != nil && wcaps.IsLogForwardingSupported() { | |
| req := guestrequest.LogForwardServiceRPCRequest{ | |
| RPCType: guestrequest.RPCStartLogForwarding, | |
| Settings: "", | |
| } | |
| err := uvm.gc.ModifyServiceSettings(ctx, prot.LogForwardService, req) | |
| if err != nil { | |
| return err | |
| } | |
| } else { | |
| log.G(ctx).WithField("os", uvm.operatingSystem).Error("Log forwarding not supported for this OS") | |
| } | |
| } | |
| return nil | |
| if uvm.OS() != "windows" || uvm.gc == nil { | |
| return nil | |
| } | |
| wcaps := gcs.GetWCOWCapabilities(uvm.gc.Capabilities()) | |
| if wcaps != nil && wcaps.IsLogForwardingSupported() { | |
| req := guestrequest.LogForwardServiceRPCRequest{ | |
| RPCType: guestrequest.RPCStartLogForwarding, | |
| Settings: "", | |
| } | |
| err := uvm.gc.ModifyServiceSettings(ctx, prot.LogForwardService, req) | |
| if err != nil { | |
| return err | |
| } | |
| } else { | |
| log.G(ctx).WithField("os", uvm.operatingSystem).Error("Log forwarding not supported for this OS") | |
| } |
Comment on lines
+127
to
+140
| type ServiceModifyPropertyType uint32 | ||
|
|
||
| const ( | ||
| LogForwardService ServiceModifyPropertyType = iota | ||
| ) | ||
|
|
||
| func (m ServiceModifyPropertyType) String() string { | ||
| switch m { | ||
| case LogForwardService: | ||
| return "LogForwardService" | ||
| default: | ||
| return fmt.Sprintf("UnknownModifyServiceType(%d)", m) | ||
| } | ||
| } |
There was a problem hiding this comment.
Can we not have ServiceModifyPropertyType be a string, similar to the PropertyType and RequestType enums, since we don't ever need to use the integer value?\
type ServiceModifyPropertyType string
const (
LogForwardService = ServiceModifyPropertyType("LogForwardService")
)
// ...
type ServiceModificationRequest struct {
RequestBase
PropertyType ServiceModifyPropertyType `json:",omitempty"`
Settings interface{} `json:",omitempty"`
}| // Original ETW Event Data may have "message" or "Message" field instead of "msg" | ||
|
|
||
| if e.Message == "" && e.Fields["message"] != nil { | ||
| e.Message = e.Fields["message"].(string) |
There was a problem hiding this comment.
this (and L78-81) will panic if for some reason the message isn't a string
Suggested change
| e.Message = e.Fields["message"].(string) | |
| if msg, ok := e.Fields["message"].(string); ok { | |
| e.Message = msg | |
| } |
| // lifecycle. This approach potentially allows to wait for reconnections, | ||
| // while limiting the number of concurrent connections to 1. | ||
| // This is useful for the case when logging service is restarted. | ||
| g.Go(func() error { |
There was a problem hiding this comment.
do we actually need this line, or can we start the below goroutine immediately (since the function passed to g.Go simply starts a go routine and returns immediately)
| ) | ||
|
|
||
| func (uvm *UtilityVM) StartLogForwarding(ctx context.Context) error { | ||
| // Implementation for stopping the log forwarder |
There was a problem hiding this comment.
Suggested change
| // Implementation for stopping the log forwarder | |
| // Implementation for starting the log forwarder |
Comment on lines
+556
to
+561
| uvm.outputHandler = opts.OutputHandlerCreator(opts.Options) | ||
| uvm.outputProcessingDone = make(chan struct{}) | ||
| uvm.outputListener, err = winio.ListenHvsock(&winio.HvsockAddr{ | ||
| VMID: uvm.RuntimeID(), | ||
| ServiceID: prot.WindowsLoggingHvsockServiceID, | ||
| }) |
There was a problem hiding this comment.
can we gate this on uvm.forwardLogs, so we can skip starting the output handler if we're not forwarding logs
Comment on lines
+269
to
+274
| key := prot.WindowsLoggingHvsockServiceID.String() | ||
| doc.VirtualMachine.Devices.HvSocket.HvSocketConfig.ServiceTable[key] = hcsschema.HvSocketServiceConfig{ | ||
| AllowWildcardBinds: true, | ||
| BindSecurityDescriptor: "D:P(A;;FA;;;SY)(A;;FA;;;BA)", | ||
| ConnectSecurityDescriptor: "D:P(A;;FA;;;SY)(A;;FA;;;BA)", | ||
| } |
There was a problem hiding this comment.
similar to CreateWCOW, can we skip this if !uvm.forwardLogs?
| // VSMBNoDirectMap specifies that no direct mapping should be used for any VSMBs added to the UVM. | ||
| VSMBNoDirectMap = "io.microsoft.virtualmachine.wcow.virtualSMB.nodirectmap" | ||
|
|
||
| // LogSources specifies the ETW providers to be set for the logging service. |
There was a problem hiding this comment.
Suggested change
| // LogSources specifies the ETW providers to be set for the logging service. | |
| // LogSources specifies the ETW providers to be set for the logging service as a base64-encoded JSON string. | |
| // | |
| // For example: | |
| // | |
| // { | |
| // "logConfig": { | |
| // "sources": [ | |
| // { | |
| // "type": "ETW", | |
| // "providers": [ | |
| // { | |
| // "providerGuid": "80CE50DE-D264-4581-950D-ABADEEE0D340", | |
| // "providerName": "Microsoft.Windows.HyperV.Compute", | |
| // "level": "Information" | |
| // } | |
| // ] | |
| // } | |
| // ] | |
| // } | |
| // } | |
| // | |
| // Would be encoded as: | |
| // | |
| // "io.microsoft.virtualmachine.wcow.logsources" = | |
| // "eyJsb2dDb25maWciOnsic291cmNlcyI6W3sidHlwZSI6IkVUVyIsInByb3ZpZGVycyI6W3sicHJvdmlkZXJHdWlkIjoiODBDRTUwREUtRDI2NC00NTgxLTk1MEQtQUJBREVFRTBEMzQwIiwicHJvdmlkZXJOYW1lIjoiTWljcm9zb2Z0LldpbmRvd3MuSHlwZXJWLkNvbXB1dGUiLCJsZXZlbCI6IkluZm9ybWF0aW9uIn1dfV19fQ==" |
Comment on lines
+64
to
+65
| LogSources string // ETW providers to be set for the logging service | ||
| ForwardLogs bool // Whether to forward logs to the host or not |
There was a problem hiding this comment.
may want to add a check in "internal\uvm\create.go".verifyOptions to error if opts.ForwardLogs && opts.LogSources == ""
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adding support to manage control plane operations and receive the log data from the Log Forward Service in the Utility VM.
Control Plane: Based on annotations passed for WCOW pod creation
HcsShimsends commands via the bridge to the GCS which relays this by calling appropriate RPCs of the Log Forward Service.Data Plane:
HcsShimcreates a HvSocket listener to receive the logs from the Log Forward Service, parses them and re-logs it to the RunHCS ETW providerControl Plane
During protocol negotiation, inbox GCS shall exhibit a new GcsCapabilities called
ModifyServiceSettingsSupportedindicating GCS supports ModifyServiceSettings. Also,GuestDefinedCapabilitesfor WCOW shall mentionLogForwardingSupportedindicating Log Forward Service is presentFor Control Plane ops, a new message category
ComputeServiceand message typeModifyServiceSettingsis added (following pattern of HCS ModifyServiceSettings). TheSettingsproperty of theModifyServiceSettingsshall mention the name of service (Log Forward Service for our case), with details of the operation to be called for it (e.g. Modify, Start, Stop). Existing hex interpreting logic to determine type of message had to be modified as they were hardcoded to only expectComputeSystemcategory of messages.Annotations for WCOW UVM Create are added
io.microsoft.virtualmachine.wcow.logsourcesio.microsoft.virtualmachine.wcow.forwardlogsBy default,
ForwardLogswould betruefor WCOW andfalsefor C-WCOW, unless specifiedData Plane
HcsShim creates the HvSocket Listener to listen for connections from the Log Forward Service. This is created irrespectively, as we plan to allow Log Forward Service to connect after UVM creation is done as well, by (later in a different PR) introduce support for enabling the ForwardLogs as part of Update call.
The HvSocket is also created to limit only one concurrent connection at a time, and allow for reconnection (and not close the listener on accept)
On accepting the connection, the output is handled by
ParseLogruswhich has been modified to expect the message to be inmessageorMessagewhich is typical in Windows ETW events