Balloon: Check WMI-Activity after restarting balloon service

Check for WMI-Activity Event ID 5858 since blnsvr.exe start.
Filter by ClientProcessId.
Use PS exit codes: 0=NONE, 1=HIT, 2=NO_PID.
Command configured in cfg.

id: 1315
Signed-off-by: Elizabeth Ashurov <eashurov@redhat.com>

Author: elizashurov

deps/balloon/check_wmi_5858.ps1

@@ -0,0 +1,41 @@
+# Check for WMI-Activity Event ID 5858 errors since blnsvr.exe started
+# Exit codes:
+#   0 - No WMI 5858 events found (NONE)
+#   1 - WMI 5858 event found (HIT)
+#   2 - Balloon service process not running (NO_PID)
+
+$ErrorActionPreference = 'SilentlyContinue'
+$log = 'Microsoft-Windows-WMI-Activity/Operational'
+
+# Get the balloon service process
+$p = Get-Process -Name blnsvr -ErrorAction SilentlyContinue | Select-Object -First 1
+if (-not $p) {
+    Write-Output 'NO_PID'
+    exit 2
+}
+
+$blnPid = $p.Id
+$start = $p.StartTime.ToUniversalTime()
+
+# Query for WMI 5858 events since the process started
+$events = Get-WinEvent -FilterHashtable @{
+    LogName   = $log
+    Id        = 5858
+    StartTime = $start
+} -MaxEvents 50 -ErrorAction SilentlyContinue |
+    Where-Object {
+        $_.Level -eq 2 -and
+        $_.Message -match ('ClientProcessId = ' + $blnPid)
+    }
+
+$e = $events | Select-Object -First 1
+
+if ($null -ne $e) {
+    Write-Output 'HIT'
+    ($e | Format-List -Property TimeCreated, Id, Message | Out-String).Trim() | Write-Output
+    exit 1
+} else {
+    Write-Output 'NONE'
+    exit 0
+}
+

qemu/tests/balloon_check.py

@@ -1,10 +1,11 @@
+import os
 import random
 import re
 import time
 
 from avocado.core import exceptions
 from avocado.utils import process
-from virttest import error_context, qemu_monitor, utils_misc, utils_test
+from virttest import data_dir, error_context, qemu_monitor, utils_misc, utils_test
 from virttest.utils_numeric import normalize_data_size
 from virttest.utils_test.qemu import MemoryBaseTest
 
@@ -501,6 +502,54 @@ def get_disk_vol(self, session):
         except Exception:
             self.test.error("Could not get virtio-win disk vol!")
 
+    def assert_no_wmi_error_5858(self, session):
+        """
+        Ensure there are no WMI-Activity Event ID 5858 entries emitted by the
+        balloon service since it started.
+        This checks the 'Microsoft-Windows-WMI-Activity/Operational' log.
+        """
+        if self.params.get("os_type") != "windows":
+            return
+        log_name = "Microsoft-Windows-WMI-Activity/Operational"
+        error_context.context(
+            "Verify no WMI 5858 events since blnsvr.exe start (log: %s)" % log_name,
+            self.test.log.info,
+        )
+
+        # Copy WMI 5858 check script from host to guest
+        balloon_deps_dir = data_dir.get_deps_dir("balloon")
+        wmi_script_name = self.params.get("wmi_check_script")
+        wmi_script_host = os.path.join(balloon_deps_dir, wmi_script_name)
+        wmi_script_guest_path = self.params.get("wmi_script_guest_path")
+        self.vm.copy_files_to(wmi_script_host, wmi_script_guest_path)
+        self.test.log.info("Copied WMI check script to guest: %s", wmi_script_guest_path)
+
+        # Execute the script
+        ps_cmd = self.params.get("wmi_5858_check_cmd") % wmi_script_guest_path
+        status, output = session.cmd_status_output(ps_cmd)
+        self.test.log.info(
+            "WMI 5858 check result: %s (status %s)",
+            output.strip(),
+            status,
+        )
+        if status == 0:
+            self.test.log.info(
+                "No WMI-Activity Event ID 5858 found since blnsvr.exe start."
+            )
+        elif status == 1:
+            self.test.fail(
+                "Detected WMI-Activity Event ID 5858 since blnsvr.exe start."
+            )
+        elif status == 2:
+            self.test.log.info(
+                "Balloon service process not running; skipping WMI 5858 check."
+            )
+        else:
+            self.test.fail(
+                "WMI 5858 check returned unexpected status %s. Output: %s"
+                % (status, output)
+            )
+
     @error_context.context_aware
     def operate_balloon_service(self, session, operation):
         """

qemu/tests/balloon_service.py

@@ -89,12 +89,19 @@ def balloon_memory(vm, mem_check, min_sz, max_sz):
         mem_stat_working = False
         for bln_oper in blnsrv_operation:
             error_context.context("%s balloon service" % bln_oper, test.log.info)
+            windows_run = params.get("os_type") == "windows" and bln_oper == "run"
             balloon_test.operate_balloon_service(session, bln_oper)
 
             error_context.context(
                 "Balloon vm memory after %s balloon service" % bln_oper, test.log.info
             )
             balloon_memory(vm, mem_check, min_sz, max_sz)
+            if windows_run:
+                error_context.context(
+                    "Check Windows Event Log for WMI 5858 after service restart",
+                    test.log.info,
+                )
+                balloon_test.assert_no_wmi_error_5858(session)
             mem_stat_working = True
         # for windows guest, disable/uninstall driver to get memory leak based on
         # driver verifier is enabled

qemu/tests/cfg/balloon_service.cfg

@@ -69,6 +69,10 @@
             only Windows
             repeat_times = 1
             blnsrv_operation = "stop run"
+            # WMI 5858 check script (copied from deps/balloon/)
+            wmi_check_script = "check_wmi_5858.ps1"
+            wmi_script_guest_path = "C:\check_wmi_5858.ps1"
+            wmi_5858_check_cmd = "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File %s"
         - sc_interrogate:
             type = balloon_sc_interrogate
             only Windows