ETW receiver with control path and session

rust/otap-dataflow/Cargo.toml

@@ -217,6 +217,7 @@ xxhash-rust = { version = "0.8", features = ["xxh3"] }
 zip = "=8.6.0"
 byte-unit = { version = "5.2.0", features = ["serde"] }
 cpu-time = "1.0.0"
+one_collect = { git = "https://github.com/swashtek/one-collect.git", rev = "4657c63" }
 
 azure_core = {version = "0.35.0", default-features = false }
 azure_identity = {version = "0.35.0", default-features = false }
@@ -295,6 +296,8 @@ contrib-processors = ["otap-df-contrib-nodes/contrib-processors"]
 condense-attributes-processor = ["otap-df-contrib-nodes/condense-attributes-processor"]
 recordset-kql-processor = ["otap-df-contrib-nodes/recordset-kql-processor"]
 resource-validator-processor = ["otap-df-contrib-nodes/resource-validator-processor"]
+# Contrib receivers (opt-in) - Windows-only
+etw-receiver = ["otap-df-contrib-nodes/etw-receiver"]
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tarpaulin_include)'] }

rust/otap-dataflow/configs/etw-console.yaml

@@ -0,0 +1,38 @@
+# ETW → Console pipeline
+#
+# Subscribes to Windows ETW providers and prints events to the console.
+#
+# Usage (run as Administrator for ETW access):
+#   cargo run -- -c configs/etw-console.yaml
+#
+# The receiver captures raw ETW events from the configured providers
+# and emits summary as an internal log/event. Full Arrow encoding is a TODO.
+
+
+version: otel_dataflow/v1
+engine: { }
+policies:
+  resources:
+    core_allocation:
+      type: core_count
+      count: 4
+groups:
+  default:
+    pipelines:
+      main:
+        nodes:
+          etw:
+            type: receiver:etw
+            config:
+              session_name: "OtelArrowETW"
+              providers:
+                # Microsoft-Windows-Kernel-Process
+                - guid: "22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716"
+                  level: information
+          console:
+            type: exporter:console
+            config: {}
+
+        connections:
+          - from: etw
+            to: console

rust/otap-dataflow/crates/contrib-nodes/Cargo.toml

@@ -54,7 +54,11 @@ reqwest = { workspace = true, optional = true, features = ["rustls-no-provider"]
 sysinfo = { workspace = true, optional = true }
 urlencoding = { workspace = true, optional = true }
 
+[target.'cfg(windows)'.dependencies]
+one_collect = { workspace = true, optional = true }
+
 [features]
+etw-receiver = ["dep:one_collect"]
 contrib-exporters = [
     "geneva-exporter",
     "azure-monitor-exporter",

rust/otap-dataflow/crates/contrib-nodes/src/lib.rs

@@ -8,3 +8,6 @@ pub mod exporters;
 
 /// Processor implementations for contrib nodes.
 pub mod processors;
+
+/// Receiver implementations for contrib nodes.
+pub mod receivers;