Skip to content

Research Archive

This directory contains all research conducted before and during the cee-exporter v2.0 milestone. Each document records the technology choices, architecture patterns, pitfalls, and code examples verified for a specific feature area.

Research was conducted on 2026-03-03 with high confidence ratings derived from direct codebase inspection and official library documentation.

This archive is historical. It records what was investigated and recommended at the time, before implementation decisions were finalized — it is not current operator guidance. Some recommendations here (for example, an acme_staging config option) were never implemented. For current configuration, see the Operator Guide.

Project-level research

Document Description
Project Summary Executive summary — stack, features, pitfalls, phase ordering rationale
Technology Stack All libraries evaluated, selected, and rejected with rationale
Architecture v2 component diagram, integration points, config additions
Features Must-have vs. should-have vs. deferred feature analysis
Pitfalls 27 concrete pitfalls across all feature areas with prevention strategies

Phase research

Phase Document Key findings
01 Quality phase-01-quality.md stdlib-only testing, http.MaxBytesReader(nil) bug fix, white-box GELF test pattern
02 Build phase-02-build.md CGO_ENABLED=0 cross-compilation, static linking, Makefile targets
03 Documentation phase-03-documentation.md mkdocs-material setup, ADR conventions, operator guide structure
04 Observability & Linux Service phase-04-observability.md Prometheus NewCounterFunc wrapping atomics, separate port 9228, hardened systemd unit
05 Windows Service phase-05-windows-service.md kardianos/service v1.2.4, DelayedAutoStart, SetRecoveryActionsOnNonCrashFailures, SCM 30-s timeout
06 SIEM Writers phase-06-siem-writers.md crewjam/rfc5424 for RFC 5424, go-lumber SyncClient for Beats, TCP octet-counting framing, TLS dialer injection
07 BinaryEvtxWriter phase-07-binary-evtx.md Pure-Go EVTX from scratch, static BinXML template, FILETIME encoding, dual-range CRC32, UTF-16LE strings
08 TLS Automation phase-08-tls-automation.md CEPA HTTP-only constraint, autocert ACME, TLS-ALPN-01 on port 443, self-signed stdlib generation, rate-limit pitfalls

Critical findings to be aware of

CEPA protocol is HTTP-only

The Dell PowerStore CEPA client sends events over plain HTTP only. Enabling TLS on port 12228 does NOT encrypt the PowerStore-to-exporter path. Always register http:// (not https://) in PowerStore CEPA configuration.

Source: Phase 8 research — confidence MEDIUM (multiple third-party guides confirm; Dell official docs blocked by 403; no counter-evidence found).

kardianos/service supersedes x/sys direct for Windows SCM

Research 05 found three critical gaps with using golang.org/x/sys/windows/svc directly: missing SetRecoveryActionsOnNonCrashFailures, no DelayedAutoStart, and unhandled SCM edge-case errors. kardianos/service v1.2.4 handles all three.

Decision recorded in ADR-010, superseding ADR-007.

No pure-Go EVTX writer library exists

All known Go EVTX projects (0xrawsec/golang-evtx, Velocidex/evtx) are parsers only. BinaryEvtxWriter must be implemented from scratch using stdlib. See ADR-009.