[bob sira (bobsira)]

Summary

• Resolve Log Monitor lint findings in production and test sources, preserving Windows/PCH include-order requirements with narrow exceptions.
• Add shared CPPLINT.cfg rules and run pinned cpplint 2.0.2 against all tracked C++ sources and headers, including tests. Retain reviewdog PR annotations and make lint diagnostics fail CI independently of annotation filtering.
• Fix the EventMonitor shutdown use-after-free: cancel event enumeration and channel-enable retries, join the worker before releasing resources, and correctly close thread, event, and remaining batch handles. Preserve the original error and close the stop event if thread creation fails.
• Add immediate-shutdown, replay-shutdown, and handle-leak regression tests. Restore stdout after EventMonitor tests and avoid loading PowerShell profiles when generating test events.

Shutdown behavior

Shutdown cancels outstanding Event Log replay rather than draining the backlog. Event reads use bounded waits and check for cancellation between batches and events. If signaling or joining the worker fails, or the existing five-second shutdown limit is exceeded, the process now fails fast instead of destroying an object still in use. The fatal path avoids acquiring the logger lock and carries the Win32 error in the exception.

Validation

• cpplint 2.0.2: all 34 tracked C++ source/header files pass.
• Release x64 and x86 builds pass with the existing local C++17 and nlohmann-json include settings.
• Full native test suites: 27/27 pass on x64 and 27/27 pass on x86, with no test-host crashes.
• ASan-instrumented EventMonitor replay probe: no sanitizer errors; shutdown completed in 0–16 ms across three runs.
• Ten isolated shutdown fault-injection scenarios pass, including cancellation before/during a batch, retry cancellation, thread-creation failure, signaling/join failures, and actual fail-fast termination with a stalled worker.

The lint-only version still reproduced the pre-existing EventMonitor crash; including the separate shutdown-fix commit makes both full suites pass.

[Copilot]

🟡 Changes recommended

The replay-shutdown regression test needs deterministic synchronization to verify cancellation and cleanup while a replay batch still contains unprocessed events.

1 open issue

• Make replay shutdown cancellation test deterministic · New

What changed in this PR

This PR strengthens Log Monitor’s C++ lint enforcement and fixes EventMonitor shutdown so worker resources are not released while still in use.

Changes:

• Apply shared lint rules to production and test sources, with CI failures independent of reviewdog annotations.
• Add cancellable Event Log reads and retries, worker joining, handle cleanup, and fail-fast shutdown handling.
• Add shutdown regression tests, restore stdout after EventMonitor tests, and document shutdown behavior.

File	Description
LogMonitor/​src/​LogMonitor/​Utility.cpp	Add explicit vector include.
LogMonitor/​src/​LogMonitor/​ProcessMonitor.cpp	Add explicit string include.
LogMonitor/​src/​LogMonitor/​pch.h	Adjust SDK include and lint suppression syntax.
LogMonitor/​src/​LogMonitor/​Main.cpp	Add explicit standard-library includes.
LogMonitor/​src/​LogMonitor/​LogFileMonitor.cpp	Add includes and remove extra whitespace.
LogMonitor/​src/​LogMonitor/​JsonFileParser.cpp	Add vector include and explain Windows macro exception.
LogMonitor/​src/​LogMonitor/​EventMonitor.h	Declare read timeout and cancellation interfaces.
LogMonitor/​src/​LogMonitor/​EventMonitor.cpp	Implement cancellation, safe shutdown, and handle cleanup.
LogMonitor/​src/​LogMonitor/​EtwMonitor.cpp	Add explicit standard-library includes.
LogMonitor/​README.md	Document lint configuration and local checks.
LogMonitor/​LogMonitorTests/​UtilityTests.cpp	Apply lint-compatible formatting.
LogMonitor/​LogMonitorTests/​Utility.h	Add license header and string include.
LogMonitor/​LogMonitorTests/​Utility.cpp	Include helper declaration and use Win32 return type.
LogMonitor/​LogMonitorTests/​pch.h	Update header guard and include-order exceptions.
LogMonitor/​LogMonitorTests/​pch.cpp	Add narrow PCH lint exception.
LogMonitor/​LogMonitorTests/​LogMonitorTests.cpp	Document implementation includes and apply lint cleanup.
LogMonitor/​LogMonitorTests/​LogFileMonitorTests.cpp	Apply lint formatting and correct status types.
LogMonitor/​LogMonitorTests/​JsonProcessorTests.cpp	Add includes and apply lint formatting.
LogMonitor/​LogMonitorTests/​EventMonitorTests.cpp	Add shutdown tests, stdout cleanup, and profile-free event generation.
LogMonitor/​LogMonitorTests/​EtwMonitorTests.cpp	Add includes and apply lint formatting.
LogMonitor/​docs/​README.md	Document cancellation and fail-fast shutdown behavior.
LogMonitor/​CPPLINT.cfg	Define shared lint rules.
.github/​workflows/​lint.yml	Pin lint tools, include tests, and separate enforcement from annotations.

_{Review effort: Balanced}