win32-eventlog 0.5.3 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/CHANGES +234 -226
- data/MANIFEST +19 -16
- data/README +78 -68
- data/Rakefile +6 -1
- data/doc/tutorial.txt +136 -136
- data/examples/example_notify.rb +23 -23
- data/examples/example_read.rb +83 -83
- data/examples/example_write.rb +64 -64
- data/lib/win32/eventlog.rb +1146 -1157
- data/lib/win32/mc.rb +120 -118
- data/lib/win32/windows/constants.rb +56 -0
- data/lib/win32/windows/functions.rb +51 -0
- data/lib/win32/windows/helper.rb +13 -0
- data/lib/win32/windows/structs.rb +30 -0
- data/misc/install_msg.rb +46 -46
- data/misc/rubymsg.mc +35 -35
- data/test/foo.mc +24 -24
- data/test/test_eventlog.rb +310 -319
- data/test/test_mc.rb +64 -67
- data/win32-eventlog.gemspec +30 -29
- metadata +90 -90
data/MANIFEST
CHANGED
@@ -1,16 +1,19 @@
|
|
1
|
-
* MANIFEST
|
2
|
-
* CHANGES
|
3
|
-
* README
|
4
|
-
* Rakefile
|
5
|
-
* win32-eventlog.gemspec
|
6
|
-
* doc/tutorial.txt
|
7
|
-
* examples/example_read.rb
|
8
|
-
* examples/example_write.rb
|
9
|
-
* examples/example_notify.rb
|
10
|
-
* lib/win32/eventlog.rb
|
11
|
-
* lib/win32/mc.rb
|
12
|
-
*
|
13
|
-
*
|
14
|
-
*
|
15
|
-
*
|
16
|
-
*
|
1
|
+
* MANIFEST
|
2
|
+
* CHANGES
|
3
|
+
* README
|
4
|
+
* Rakefile
|
5
|
+
* win32-eventlog.gemspec
|
6
|
+
* doc/tutorial.txt
|
7
|
+
* examples/example_read.rb
|
8
|
+
* examples/example_write.rb
|
9
|
+
* examples/example_notify.rb
|
10
|
+
* lib/win32/eventlog.rb
|
11
|
+
* lib/win32/mc.rb
|
12
|
+
* lib/win32/windows/constants.rb
|
13
|
+
* lib/win32/windows/functions.rb
|
14
|
+
* lib/win32/windows/structs.rb
|
15
|
+
* misc/install_msg.rb
|
16
|
+
* misc/rubymsg.mc
|
17
|
+
* test/foo.mc
|
18
|
+
* test/test_eventlog.rb
|
19
|
+
* test/test_mc.rb
|
data/README
CHANGED
@@ -1,68 +1,78 @@
|
|
1
|
-
== Description
|
2
|
-
The win32-eventlog library provides an interface for reading from and
|
3
|
-
writing to the MS Windows Event Log.
|
4
|
-
|
5
|
-
In addition, you can create your own message event sources using the
|
6
|
-
|
7
|
-
proper tools installed.
|
8
|
-
|
9
|
-
== Prerequisites
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
57
|
-
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
==
|
62
|
-
|
63
|
-
|
64
|
-
|
65
|
-
|
66
|
-
|
67
|
-
|
68
|
-
|
1
|
+
== Description
|
2
|
+
The win32-eventlog library provides an interface for reading from and
|
3
|
+
writing to the MS Windows Event Log.
|
4
|
+
|
5
|
+
In addition, you can create your own message event sources using the
|
6
|
+
Win32::MC class (provided with this distro), assuming you have the
|
7
|
+
proper tools installed.
|
8
|
+
|
9
|
+
== Prerequisites
|
10
|
+
* ffi
|
11
|
+
* Windows Vista or later
|
12
|
+
|
13
|
+
The 'mc', 'rc' and 'link' command line tools are required to create and
|
14
|
+
install message sources. You won't need these for simply reading from or
|
15
|
+
writing to an existing event log.
|
16
|
+
|
17
|
+
== Installation
|
18
|
+
gem install win32-eventlog
|
19
|
+
|
20
|
+
== Synopsis
|
21
|
+
require 'win32/eventlog'
|
22
|
+
require 'win32/mc' # If you want to create message files.
|
23
|
+
|
24
|
+
Win32::EventLog.read('Application') do |log|
|
25
|
+
p log
|
26
|
+
end
|
27
|
+
|
28
|
+
=== General Installation Notes
|
29
|
+
This will install both the win32-eventlog and win32-mc libraries. The latter
|
30
|
+
is strictly for turning .mc files into .dll files. See the mc documentation
|
31
|
+
for more details.
|
32
|
+
|
33
|
+
== Installing the 'RubyMsg' event source
|
34
|
+
If you wish to install the RubyMsg event source then run the
|
35
|
+
event_source:install Rake task. This will create a 'rubymsg' directory
|
36
|
+
under your toplevel Ruby installation directory (usually C:\ruby), and
|
37
|
+
create the .dll, .h, .rc and .res files there, in addition to copying the
|
38
|
+
rubymsg.mc file. It will then install the 'RubyMsg' event source into your
|
39
|
+
registry.
|
40
|
+
|
41
|
+
DO NOT MOVE THE DLL FILE ONCE IT IS INSTALLED! If you do, you will have
|
42
|
+
to delete the registry entry and reinstall it with the correct path.
|
43
|
+
|
44
|
+
Take a look at the rubymsg.mc file for the category and message values. If
|
45
|
+
you do not understand this, please read the 'tutorial.txt' file in the 'doc'
|
46
|
+
directory.
|
47
|
+
|
48
|
+
== Additional documentation
|
49
|
+
If you are unfamiliar with message files and event logging on Windows in
|
50
|
+
general, please read the 'tutorial.txt' file.
|
51
|
+
|
52
|
+
There are also a couple of sample test scripts under the 'examples'
|
53
|
+
directory if you want to futz around and get a feel for how things work.
|
54
|
+
|
55
|
+
== If the test_mc.rb tests are skipped
|
56
|
+
If the tests from the test_mc.rb file are omitted then you either don't
|
57
|
+
have the mc, rc and/or link commands installed or they're not in your
|
58
|
+
system's %PATH%. If you have MSVC++, you should have them somewhere on your
|
59
|
+
system.
|
60
|
+
|
61
|
+
== Known Issues
|
62
|
+
JRuby users may need to increase their heap space.
|
63
|
+
|
64
|
+
Please file any bug reports on the project page at
|
65
|
+
http://github.com/djberg96/win32-eventlog or
|
66
|
+
http://www.rubyforge.org/projects/win32utils.
|
67
|
+
|
68
|
+
== License
|
69
|
+
Artistic 2.0
|
70
|
+
|
71
|
+
== Warranty
|
72
|
+
This package is provided "as is" and without any express or
|
73
|
+
implied warranties, including, without limitation, the implied
|
74
|
+
warranties of merchantability and fitness for a particular purpose.
|
75
|
+
|
76
|
+
== Authors
|
77
|
+
Daniel J. Berger
|
78
|
+
Park Heesob
|
data/Rakefile
CHANGED
@@ -8,7 +8,12 @@ namespace :gem do
|
|
8
8
|
desc 'Create the win32-eventlog gem'
|
9
9
|
task :create => [:clean] do
|
10
10
|
spec = eval(IO.read('win32-eventlog.gemspec'))
|
11
|
-
Gem::
|
11
|
+
if Gem::VERSION < "2.0"
|
12
|
+
Gem::Builder.new(spec).build
|
13
|
+
else
|
14
|
+
require 'rubygems/package'
|
15
|
+
Gem::Package.build(spec)
|
16
|
+
end
|
12
17
|
end
|
13
18
|
|
14
19
|
desc 'Install the win32-eventlog gem'
|
data/doc/tutorial.txt
CHANGED
@@ -1,137 +1,137 @@
|
|
1
|
-
== Information about Message Files
|
2
|
-
Each event source should register message files that contain description
|
3
|
-
strings for each event identifier, event category, and parameter. Register
|
4
|
-
these files in the EventMessageFile, CategoryMessageFile, and
|
5
|
-
ParameterMessageFile registry values for the event source.
|
6
|
-
|
7
|
-
You can create one message file that contains descriptions for the event
|
8
|
-
identifiers, categories, and parameters, or create three separate message
|
9
|
-
files. Several applications can share the same message file.
|
10
|
-
|
11
|
-
You should typically create message files as resource-only DLLs. They are
|
12
|
-
smaller and faster than ordinary DLLs.
|
13
|
-
|
14
|
-
== What does a .mc file look like?
|
15
|
-
|
16
|
-
A .mc file is just a plain text file that is parsed by the "mc" utility to
|
17
|
-
generate a header and, ultimately, a .dll file. Here is a quick sample.
|
18
|
-
Note that there must be a newline after the last '.' at the bottom.
|
19
|
-
The ';' character denotes a comment.
|
20
|
-
|
21
|
-
; foo.mc
|
22
|
-
MessageId=0x1
|
23
|
-
SymbolicName=CATEGORY_ERROR
|
24
|
-
Language=English
|
25
|
-
error
|
26
|
-
.
|
27
|
-
|
28
|
-
MessageId=0x2
|
29
|
-
SymbolicName=CATEGORY_WARNING
|
30
|
-
Language=English
|
31
|
-
warning
|
32
|
-
.
|
33
|
-
|
34
|
-
MessageId=0x3
|
35
|
-
Severity=Error
|
36
|
-
SymbolicName=FOO_ERROR
|
37
|
-
Language=English
|
38
|
-
Error: %1
|
39
|
-
.
|
40
|
-
|
41
|
-
== How to generate a .dll file from a .mc file
|
42
|
-
To turn this file into a .dll you have two options. The first is to use the
|
43
|
-
command line utilities. Follow these steps:
|
44
|
-
|
45
|
-
1) mc filename.mc
|
46
|
-
2) rc -r -fo filename.res filename.rc
|
47
|
-
3) link -dll -noentry -out:filename.dll filename.res
|
48
|
-
|
49
|
-
Your other option is to use the win32-mc library, which is a simple wrapper
|
50
|
-
for the above commands, and is included with this library. You now have a
|
51
|
-
dll that you can associate with your event source (i.e. the one you associate
|
52
|
-
with your application). You can also take a look at the C header file that
|
53
|
-
.mc generates and use that in your own extensions if you like.
|
54
|
-
|
55
|
-
After this you'll need to register your event source and associate the .dll
|
56
|
-
file with it. To do that, use the EventLog.add_event_source method. Be sure
|
57
|
-
to specify the number of categories manually - it is not calculated
|
58
|
-
automatically by the OS.
|
59
|
-
|
60
|
-
Returning to the .mc file, the example I used actually creates two categories,
|
61
|
-
"error" and "warning", and one event message. The numbers you assign here
|
62
|
-
create corresponding (though not identical) values in the header file that
|
63
|
-
is generated. It is the values found in the header file that you pass to the
|
64
|
-
EventLog#report_event method for the category or event id. Here's the
|
65
|
-
relevant data from the foo.h file (using foo.mc above):
|
66
|
-
|
67
|
-
#define CATEGORY_ERROR 0x00000001L
|
68
|
-
#define CATEGORY_WARNING 0x00000002L
|
69
|
-
#define FOO_ERROR 0xC0000003L
|
70
|
-
|
71
|
-
In the case of categories, that number is the name number that shows up in the
|
72
|
-
"category" field in the Event Viewer. In the case of event message files, it
|
73
|
-
is the text that shows up in the event description.
|
74
|
-
|
75
|
-
The "data" field is what replaces "%1" as an actual text string in the event
|
76
|
-
log, sort of like a printf format specifier, except that it's always a string.
|
77
|
-
|
78
|
-
== Registering an event source
|
79
|
-
First, create the .dll file from the .mc file. Then register that .dll file
|
80
|
-
for an event source we'll call "foo". You can name the .dll file anything
|
81
|
-
you like, but for sanity's sake I recommend keeping the same as the event
|
82
|
-
source name.
|
83
|
-
|
84
|
-
require 'win32/eventlog'
|
85
|
-
include Win32
|
86
|
-
|
87
|
-
dll_file = 'c:\\wherever\\foo.dll'
|
88
|
-
|
89
|
-
EventLog.add_event_source(
|
90
|
-
:source => 'Application',
|
91
|
-
:key_name => 'foo',
|
92
|
-
:category_count => 2,
|
93
|
-
:event_message_file => dll_file,
|
94
|
-
:category_message_file => dll_file
|
95
|
-
)
|
96
|
-
|
97
|
-
After you run this, you can run 'regedit' and see that your event source has
|
98
|
-
been inserted into the registry. You can find it under:
|
99
|
-
|
100
|
-
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application.
|
101
|
-
|
102
|
-
== Writing to the event source
|
103
|
-
Now that our event source 'foo' is registered, we can begin writing event
|
104
|
-
log data for it. Here's an example of how you use it:
|
105
|
-
|
106
|
-
require 'win32/eventlog'
|
107
|
-
include Win32
|
108
|
-
|
109
|
-
EventLog.open('Application') do |log|
|
110
|
-
log.report_event(
|
111
|
-
:source => 'foo',
|
112
|
-
:event_type => EventLog::WARN,
|
113
|
-
:category => '0x00000002L'.hex,
|
114
|
-
:event_id => '0x00000003L'.hex,
|
115
|
-
:data => 'I'm warning you!'
|
116
|
-
)
|
117
|
-
end
|
118
|
-
|
119
|
-
Note the values used for the 'category' and 'event_id' keys. Those are the
|
120
|
-
values that were generated automatically in the foo.h file that I showed you
|
121
|
-
above. You'll have to manually inspect the header file that's generated to
|
122
|
-
determine which values you should be using.
|
123
|
-
|
124
|
-
You can now open your event log viewer and look at the message. You can get
|
125
|
-
to your event log viewer via Start -> Control Panel -> Administrative Tools ->
|
126
|
-
Event Viewer. You should see a warning message with the category "warning"
|
127
|
-
and an event id of '3'. If you right click on that entry and select
|
128
|
-
"properties", you can see the event description is "Warning: I'm warning you!".
|
129
|
-
|
130
|
-
== More Info
|
131
|
-
For more information visit the following URL's:
|
132
|
-
|
133
|
-
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tools/tools/message_text_file_syntax.asp
|
134
|
-
|
135
|
-
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/message_files.asp
|
136
|
-
|
1
|
+
== Information about Message Files
|
2
|
+
Each event source should register message files that contain description
|
3
|
+
strings for each event identifier, event category, and parameter. Register
|
4
|
+
these files in the EventMessageFile, CategoryMessageFile, and
|
5
|
+
ParameterMessageFile registry values for the event source.
|
6
|
+
|
7
|
+
You can create one message file that contains descriptions for the event
|
8
|
+
identifiers, categories, and parameters, or create three separate message
|
9
|
+
files. Several applications can share the same message file.
|
10
|
+
|
11
|
+
You should typically create message files as resource-only DLLs. They are
|
12
|
+
smaller and faster than ordinary DLLs.
|
13
|
+
|
14
|
+
== What does a .mc file look like?
|
15
|
+
|
16
|
+
A .mc file is just a plain text file that is parsed by the "mc" utility to
|
17
|
+
generate a header and, ultimately, a .dll file. Here is a quick sample.
|
18
|
+
Note that there must be a newline after the last '.' at the bottom.
|
19
|
+
The ';' character denotes a comment.
|
20
|
+
|
21
|
+
; foo.mc
|
22
|
+
MessageId=0x1
|
23
|
+
SymbolicName=CATEGORY_ERROR
|
24
|
+
Language=English
|
25
|
+
error
|
26
|
+
.
|
27
|
+
|
28
|
+
MessageId=0x2
|
29
|
+
SymbolicName=CATEGORY_WARNING
|
30
|
+
Language=English
|
31
|
+
warning
|
32
|
+
.
|
33
|
+
|
34
|
+
MessageId=0x3
|
35
|
+
Severity=Error
|
36
|
+
SymbolicName=FOO_ERROR
|
37
|
+
Language=English
|
38
|
+
Error: %1
|
39
|
+
.
|
40
|
+
|
41
|
+
== How to generate a .dll file from a .mc file
|
42
|
+
To turn this file into a .dll you have two options. The first is to use the
|
43
|
+
command line utilities. Follow these steps:
|
44
|
+
|
45
|
+
1) mc filename.mc
|
46
|
+
2) rc -r -fo filename.res filename.rc
|
47
|
+
3) link -dll -noentry -out:filename.dll filename.res
|
48
|
+
|
49
|
+
Your other option is to use the win32-mc library, which is a simple wrapper
|
50
|
+
for the above commands, and is included with this library. You now have a
|
51
|
+
dll that you can associate with your event source (i.e. the one you associate
|
52
|
+
with your application). You can also take a look at the C header file that
|
53
|
+
.mc generates and use that in your own extensions if you like.
|
54
|
+
|
55
|
+
After this you'll need to register your event source and associate the .dll
|
56
|
+
file with it. To do that, use the EventLog.add_event_source method. Be sure
|
57
|
+
to specify the number of categories manually - it is not calculated
|
58
|
+
automatically by the OS.
|
59
|
+
|
60
|
+
Returning to the .mc file, the example I used actually creates two categories,
|
61
|
+
"error" and "warning", and one event message. The numbers you assign here
|
62
|
+
create corresponding (though not identical) values in the header file that
|
63
|
+
is generated. It is the values found in the header file that you pass to the
|
64
|
+
EventLog#report_event method for the category or event id. Here's the
|
65
|
+
relevant data from the foo.h file (using foo.mc above):
|
66
|
+
|
67
|
+
#define CATEGORY_ERROR 0x00000001L
|
68
|
+
#define CATEGORY_WARNING 0x00000002L
|
69
|
+
#define FOO_ERROR 0xC0000003L
|
70
|
+
|
71
|
+
In the case of categories, that number is the name number that shows up in the
|
72
|
+
"category" field in the Event Viewer. In the case of event message files, it
|
73
|
+
is the text that shows up in the event description.
|
74
|
+
|
75
|
+
The "data" field is what replaces "%1" as an actual text string in the event
|
76
|
+
log, sort of like a printf format specifier, except that it's always a string.
|
77
|
+
|
78
|
+
== Registering an event source
|
79
|
+
First, create the .dll file from the .mc file. Then register that .dll file
|
80
|
+
for an event source we'll call "foo". You can name the .dll file anything
|
81
|
+
you like, but for sanity's sake I recommend keeping the same as the event
|
82
|
+
source name.
|
83
|
+
|
84
|
+
require 'win32/eventlog'
|
85
|
+
include Win32
|
86
|
+
|
87
|
+
dll_file = 'c:\\wherever\\foo.dll'
|
88
|
+
|
89
|
+
EventLog.add_event_source(
|
90
|
+
:source => 'Application',
|
91
|
+
:key_name => 'foo',
|
92
|
+
:category_count => 2,
|
93
|
+
:event_message_file => dll_file,
|
94
|
+
:category_message_file => dll_file
|
95
|
+
)
|
96
|
+
|
97
|
+
After you run this, you can run 'regedit' and see that your event source has
|
98
|
+
been inserted into the registry. You can find it under:
|
99
|
+
|
100
|
+
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application.
|
101
|
+
|
102
|
+
== Writing to the event source
|
103
|
+
Now that our event source 'foo' is registered, we can begin writing event
|
104
|
+
log data for it. Here's an example of how you use it:
|
105
|
+
|
106
|
+
require 'win32/eventlog'
|
107
|
+
include Win32
|
108
|
+
|
109
|
+
EventLog.open('Application') do |log|
|
110
|
+
log.report_event(
|
111
|
+
:source => 'foo',
|
112
|
+
:event_type => EventLog::WARN,
|
113
|
+
:category => '0x00000002L'.hex,
|
114
|
+
:event_id => '0x00000003L'.hex,
|
115
|
+
:data => 'I'm warning you!'
|
116
|
+
)
|
117
|
+
end
|
118
|
+
|
119
|
+
Note the values used for the 'category' and 'event_id' keys. Those are the
|
120
|
+
values that were generated automatically in the foo.h file that I showed you
|
121
|
+
above. You'll have to manually inspect the header file that's generated to
|
122
|
+
determine which values you should be using.
|
123
|
+
|
124
|
+
You can now open your event log viewer and look at the message. You can get
|
125
|
+
to your event log viewer via Start -> Control Panel -> Administrative Tools ->
|
126
|
+
Event Viewer. You should see a warning message with the category "warning"
|
127
|
+
and an event id of '3'. If you right click on that entry and select
|
128
|
+
"properties", you can see the event description is "Warning: I'm warning you!".
|
129
|
+
|
130
|
+
== More Info
|
131
|
+
For more information visit the following URL's:
|
132
|
+
|
133
|
+
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tools/tools/message_text_file_syntax.asp
|
134
|
+
|
135
|
+
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/message_files.asp
|
136
|
+
|
137
137
|
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tools/tools/header_section.asp
|