win32-eventlog 0.6.3 → 0.6.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- checksums.yaml.gz.sig +2 -0
- data.tar.gz.sig +2 -0
- data/CHANGES +254 -248
- data/MANIFEST +21 -19
- data/README +81 -82
- data/Rakefile +3 -6
- data/certs/djberg96_pub.pem +21 -0
- data/doc/tutorial.txt +136 -136
- data/examples/example_notify.rb +23 -23
- data/examples/example_read.rb +83 -83
- data/examples/example_write.rb +64 -64
- data/lib/win32-eventlog.rb +1 -0
- data/lib/win32/eventlog.rb +1139 -1139
- data/lib/win32/mc.rb +120 -120
- data/lib/win32/windows/constants.rb +56 -56
- data/lib/win32/windows/functions.rb +61 -61
- data/lib/win32/windows/helper.rb +13 -13
- data/lib/win32/windows/structs.rb +30 -30
- data/misc/install_msg.rb +46 -46
- data/misc/rubymsg.mc +35 -35
- data/test/foo.mc +24 -24
- data/test/test_eventlog.rb +319 -319
- data/test/test_mc.rb +64 -64
- data/win32-eventlog.gemspec +30 -30
- metadata +29 -5
- metadata.gz.sig +0 -0
data/MANIFEST
CHANGED
@@ -1,19 +1,21 @@
|
|
1
|
-
* MANIFEST
|
2
|
-
* CHANGES
|
3
|
-
* README
|
4
|
-
* Rakefile
|
5
|
-
* win32-eventlog.gemspec
|
6
|
-
* doc/tutorial.txt
|
7
|
-
* examples/example_read.rb
|
8
|
-
* examples/example_write.rb
|
9
|
-
* examples/example_notify.rb
|
10
|
-
*
|
11
|
-
* lib/win32
|
12
|
-
* lib/win32/
|
13
|
-
* lib/win32/
|
14
|
-
* lib/win32/windows/
|
15
|
-
*
|
16
|
-
*
|
17
|
-
*
|
18
|
-
*
|
19
|
-
* test/
|
1
|
+
* MANIFEST
|
2
|
+
* CHANGES
|
3
|
+
* README
|
4
|
+
* Rakefile
|
5
|
+
* win32-eventlog.gemspec
|
6
|
+
* doc/tutorial.txt
|
7
|
+
* examples/example_read.rb
|
8
|
+
* examples/example_write.rb
|
9
|
+
* examples/example_notify.rb
|
10
|
+
* certs/djberg96_pub.pem
|
11
|
+
* lib/win32-eventlog.rb
|
12
|
+
* lib/win32/eventlog.rb
|
13
|
+
* lib/win32/mc.rb
|
14
|
+
* lib/win32/windows/constants.rb
|
15
|
+
* lib/win32/windows/functions.rb
|
16
|
+
* lib/win32/windows/structs.rb
|
17
|
+
* misc/install_msg.rb
|
18
|
+
* misc/rubymsg.mc
|
19
|
+
* test/foo.mc
|
20
|
+
* test/test_eventlog.rb
|
21
|
+
* test/test_mc.rb
|
data/README
CHANGED
@@ -1,82 +1,81 @@
|
|
1
|
-
== Description
|
2
|
-
The win32-eventlog library provides an interface for reading from and
|
3
|
-
writing to the MS Windows Event Log.
|
4
|
-
|
5
|
-
In addition, you can create your own message event sources using the
|
6
|
-
Win32::MC class (provided with this distro), assuming you have the
|
7
|
-
proper tools installed.
|
8
|
-
|
9
|
-
== Prerequisites
|
10
|
-
* ffi
|
11
|
-
* Windows Vista or later
|
12
|
-
|
13
|
-
The 'mc', 'rc' and 'link' command line tools are required to create and
|
14
|
-
install message sources. You won't need these for simply reading from or
|
15
|
-
writing to an existing event log.
|
16
|
-
|
17
|
-
== Installation
|
18
|
-
gem install win32-eventlog
|
19
|
-
|
20
|
-
== Synopsis
|
21
|
-
require 'win32/eventlog'
|
22
|
-
require 'win32/mc' # If you want to create message files.
|
23
|
-
|
24
|
-
Win32::EventLog.read('Application') do |log|
|
25
|
-
p log
|
26
|
-
end
|
27
|
-
|
28
|
-
=== General Installation Notes
|
29
|
-
This will install both the win32-eventlog and win32-mc libraries. The latter
|
30
|
-
is strictly for turning .mc files into .dll files. See the mc documentation
|
31
|
-
for more details.
|
32
|
-
|
33
|
-
== Installing the 'RubyMsg' event source
|
34
|
-
If you wish to install the RubyMsg event source then run the
|
35
|
-
event_source:install Rake task. This will create a 'rubymsg' directory
|
36
|
-
under your toplevel Ruby installation directory (usually C:\ruby), and
|
37
|
-
create the .dll, .h, .rc and .res files there, in addition to copying the
|
38
|
-
rubymsg.mc file. It will then install the 'RubyMsg' event source into your
|
39
|
-
registry.
|
40
|
-
|
41
|
-
DO NOT MOVE THE DLL FILE ONCE IT IS INSTALLED! If you do, you will have
|
42
|
-
to delete the registry entry and reinstall it with the correct path.
|
43
|
-
|
44
|
-
Take a look at the rubymsg.mc file for the category and message values. If
|
45
|
-
you do not understand this, please read the 'tutorial.txt' file in the 'doc'
|
46
|
-
directory.
|
47
|
-
|
48
|
-
== Additional documentation
|
49
|
-
If you are unfamiliar with message files and event logging on Windows in
|
50
|
-
general, please read the 'tutorial.txt' file.
|
51
|
-
|
52
|
-
There are also a couple of sample test scripts under the 'examples'
|
53
|
-
directory if you want to futz around and get a feel for how things work.
|
54
|
-
|
55
|
-
== If the test_mc.rb tests are skipped
|
56
|
-
If the tests from the test_mc.rb file are omitted then you either don't
|
57
|
-
have the mc, rc and/or link commands installed or they're not in your
|
58
|
-
system's %PATH%. If you have MSVC++, you should have them somewhere on your
|
59
|
-
system.
|
60
|
-
|
61
|
-
== Known Issues
|
62
|
-
* JRuby users may need to increase their heap space.
|
63
|
-
|
64
|
-
|
65
|
-
|
66
|
-
|
67
|
-
|
68
|
-
|
69
|
-
|
70
|
-
|
71
|
-
|
72
|
-
|
73
|
-
|
74
|
-
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
Park Heesob
|
1
|
+
== Description
|
2
|
+
The win32-eventlog library provides an interface for reading from and
|
3
|
+
writing to the MS Windows Event Log.
|
4
|
+
|
5
|
+
In addition, you can create your own message event sources using the
|
6
|
+
Win32::MC class (provided with this distro), assuming you have the
|
7
|
+
proper tools installed.
|
8
|
+
|
9
|
+
== Prerequisites
|
10
|
+
* ffi
|
11
|
+
* Windows Vista or later
|
12
|
+
|
13
|
+
The 'mc', 'rc' and 'link' command line tools are required to create and
|
14
|
+
install message sources. You won't need these for simply reading from or
|
15
|
+
writing to an existing event log.
|
16
|
+
|
17
|
+
== Installation
|
18
|
+
gem install win32-eventlog
|
19
|
+
|
20
|
+
== Synopsis
|
21
|
+
require 'win32/eventlog'
|
22
|
+
require 'win32/mc' # If you want to create message files.
|
23
|
+
|
24
|
+
Win32::EventLog.read('Application') do |log|
|
25
|
+
p log
|
26
|
+
end
|
27
|
+
|
28
|
+
=== General Installation Notes
|
29
|
+
This will install both the win32-eventlog and win32-mc libraries. The latter
|
30
|
+
is strictly for turning .mc files into .dll files. See the mc documentation
|
31
|
+
for more details.
|
32
|
+
|
33
|
+
== Installing the 'RubyMsg' event source
|
34
|
+
If you wish to install the RubyMsg event source then run the
|
35
|
+
event_source:install Rake task. This will create a 'rubymsg' directory
|
36
|
+
under your toplevel Ruby installation directory (usually C:\ruby), and
|
37
|
+
create the .dll, .h, .rc and .res files there, in addition to copying the
|
38
|
+
rubymsg.mc file. It will then install the 'RubyMsg' event source into your
|
39
|
+
registry.
|
40
|
+
|
41
|
+
DO NOT MOVE THE DLL FILE ONCE IT IS INSTALLED! If you do, you will have
|
42
|
+
to delete the registry entry and reinstall it with the correct path.
|
43
|
+
|
44
|
+
Take a look at the rubymsg.mc file for the category and message values. If
|
45
|
+
you do not understand this, please read the 'tutorial.txt' file in the 'doc'
|
46
|
+
directory.
|
47
|
+
|
48
|
+
== Additional documentation
|
49
|
+
If you are unfamiliar with message files and event logging on Windows in
|
50
|
+
general, please read the 'tutorial.txt' file.
|
51
|
+
|
52
|
+
There are also a couple of sample test scripts under the 'examples'
|
53
|
+
directory if you want to futz around and get a feel for how things work.
|
54
|
+
|
55
|
+
== If the test_mc.rb tests are skipped
|
56
|
+
If the tests from the test_mc.rb file are omitted then you either don't
|
57
|
+
have the mc, rc and/or link commands installed or they're not in your
|
58
|
+
system's %PATH%. If you have MSVC++, you should have them somewhere on your
|
59
|
+
system.
|
60
|
+
|
61
|
+
== Known Issues
|
62
|
+
* JRuby users may need to increase their heap space.
|
63
|
+
|
64
|
+
Please file any bug reports on the project page at
|
65
|
+
http://github.com/djberg96/win32-eventlog.
|
66
|
+
|
67
|
+
== Alternatives
|
68
|
+
You can use ruby-wmi + Win32_NTLogEvent to get Windows eventlog information
|
69
|
+
using OLE behind the scenes.
|
70
|
+
|
71
|
+
== License
|
72
|
+
Artistic 2.0
|
73
|
+
|
74
|
+
== Warranty
|
75
|
+
This package is provided "as is" and without any express or
|
76
|
+
implied warranties, including, without limitation, the implied
|
77
|
+
warranties of merchantability and fitness for a particular purpose.
|
78
|
+
|
79
|
+
== Authors
|
80
|
+
Daniel J. Berger
|
81
|
+
Park Heesob
|
data/Rakefile
CHANGED
@@ -7,13 +7,10 @@ CLEAN.include('**/*.gem', '**/*.rbc')
|
|
7
7
|
namespace :gem do
|
8
8
|
desc 'Create the win32-eventlog gem'
|
9
9
|
task :create => [:clean] do
|
10
|
+
require 'rubygems/package'
|
10
11
|
spec = eval(IO.read('win32-eventlog.gemspec'))
|
11
|
-
|
12
|
-
|
13
|
-
else
|
14
|
-
require 'rubygems/package'
|
15
|
-
Gem::Package.build(spec)
|
16
|
-
end
|
12
|
+
spec.signing_key = File.join(Dir.home, '.ssh', 'gem-private_key.pem')
|
13
|
+
Gem::Package.build(spec)
|
17
14
|
end
|
18
15
|
|
19
16
|
desc 'Install the win32-eventlog gem'
|
@@ -0,0 +1,21 @@
|
|
1
|
+
-----BEGIN CERTIFICATE-----
|
2
|
+
MIIDcDCCAligAwIBAgIBATANBgkqhkiG9w0BAQUFADA/MREwDwYDVQQDDAhkamJl
|
3
|
+
cmc5NjEVMBMGCgmSJomT8ixkARkWBWdtYWlsMRMwEQYKCZImiZPyLGQBGRYDY29t
|
4
|
+
MB4XDTE1MDkwMjIwNDkxOFoXDTE2MDkwMTIwNDkxOFowPzERMA8GA1UEAwwIZGpi
|
5
|
+
ZXJnOTYxFTATBgoJkiaJk/IsZAEZFgVnbWFpbDETMBEGCgmSJomT8ixkARkWA2Nv
|
6
|
+
bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMyTkvXqRp6hLs9eoJOS
|
7
|
+
Hmi8kRYbq9Vkf15/hMxJpotYMgJVHHWrmDcC5Dye2PbnXjTkKf266Zw0PtT9h+lI
|
8
|
+
S3ts9HO+vaCFSMwFFZmnWJSpQ3CNw2RcHxjWkk9yF7imEM8Kz9ojhiDXzBetdV6M
|
9
|
+
gr0lV/alUr7TNVBDngbXEfTWscyXh1qd7xZ4EcOdsDktCe5G45N/o3662tPQvJsi
|
10
|
+
FOF0CM/KuBsa/HL1/eoEmF4B3EKIRfTHrQ3hu20Kv3RJ88QM4ec2+0dd97uX693O
|
11
|
+
zv6981fyEg+aXLkxrkViM/tz2qR2ZE0jPhHTREPYeMEgptRkTmWSKAuLVWrJEfgl
|
12
|
+
DtkCAwEAAaN3MHUwCQYDVR0TBAIwADALBgNVHQ8EBAMCBLAwHQYDVR0OBBYEFEwe
|
13
|
+
nn6bfJADmuIDiMSOzedOrL+xMB0GA1UdEQQWMBSBEmRqYmVyZzk2QGdtYWlsLmNv
|
14
|
+
bTAdBgNVHRIEFjAUgRJkamJlcmc5NkBnbWFpbC5jb20wDQYJKoZIhvcNAQEFBQAD
|
15
|
+
ggEBAHmNOCWoDVD75zHFueY0viwGDVP1BNGFC+yXcb7u2GlK+nEMCORqzURbYPf7
|
16
|
+
tL+/hzmePIRz7i30UM//64GI1NLv9jl7nIwjhPpXpf7/lu2I9hOTsvwSumb5UiKC
|
17
|
+
/sqBxI3sfj9pr79Wpv4MuikX1XPik7Ncb7NPsJPw06Lvyc3Hkg5X2XpPtLtS+Gr2
|
18
|
+
wKJnmzb5rIPS1cmsqv0M9LPWflzfwoZ/SpnmhagP+g05p8bRNKjZSA2iImM/GyYZ
|
19
|
+
EJYzxdPOrx2n6NYR3Hk+vHP0U7UBSveI6+qx+ndQYaeyCn+GRX2PKS9h66YF/Q1V
|
20
|
+
tGSHgAmcLlkdGgan182qsE/4kKM=
|
21
|
+
-----END CERTIFICATE-----
|
data/doc/tutorial.txt
CHANGED
@@ -1,137 +1,137 @@
|
|
1
|
-
== Information about Message Files
|
2
|
-
Each event source should register message files that contain description
|
3
|
-
strings for each event identifier, event category, and parameter. Register
|
4
|
-
these files in the EventMessageFile, CategoryMessageFile, and
|
5
|
-
ParameterMessageFile registry values for the event source.
|
6
|
-
|
7
|
-
You can create one message file that contains descriptions for the event
|
8
|
-
identifiers, categories, and parameters, or create three separate message
|
9
|
-
files. Several applications can share the same message file.
|
10
|
-
|
11
|
-
You should typically create message files as resource-only DLLs. They are
|
12
|
-
smaller and faster than ordinary DLLs.
|
13
|
-
|
14
|
-
== What does a .mc file look like?
|
15
|
-
|
16
|
-
A .mc file is just a plain text file that is parsed by the "mc" utility to
|
17
|
-
generate a header and, ultimately, a .dll file. Here is a quick sample.
|
18
|
-
Note that there must be a newline after the last '.' at the bottom.
|
19
|
-
The ';' character denotes a comment.
|
20
|
-
|
21
|
-
; foo.mc
|
22
|
-
MessageId=0x1
|
23
|
-
SymbolicName=CATEGORY_ERROR
|
24
|
-
Language=English
|
25
|
-
error
|
26
|
-
.
|
27
|
-
|
28
|
-
MessageId=0x2
|
29
|
-
SymbolicName=CATEGORY_WARNING
|
30
|
-
Language=English
|
31
|
-
warning
|
32
|
-
.
|
33
|
-
|
34
|
-
MessageId=0x3
|
35
|
-
Severity=Error
|
36
|
-
SymbolicName=FOO_ERROR
|
37
|
-
Language=English
|
38
|
-
Error: %1
|
39
|
-
.
|
40
|
-
|
41
|
-
== How to generate a .dll file from a .mc file
|
42
|
-
To turn this file into a .dll you have two options. The first is to use the
|
43
|
-
command line utilities. Follow these steps:
|
44
|
-
|
45
|
-
1) mc filename.mc
|
46
|
-
2) rc -r -fo filename.res filename.rc
|
47
|
-
3) link -dll -noentry -out:filename.dll filename.res
|
48
|
-
|
49
|
-
Your other option is to use the win32-mc library, which is a simple wrapper
|
50
|
-
for the above commands, and is included with this library. You now have a
|
51
|
-
dll that you can associate with your event source (i.e. the one you associate
|
52
|
-
with your application). You can also take a look at the C header file that
|
53
|
-
.mc generates and use that in your own extensions if you like.
|
54
|
-
|
55
|
-
After this you'll need to register your event source and associate the .dll
|
56
|
-
file with it. To do that, use the EventLog.add_event_source method. Be sure
|
57
|
-
to specify the number of categories manually - it is not calculated
|
58
|
-
automatically by the OS.
|
59
|
-
|
60
|
-
Returning to the .mc file, the example I used actually creates two categories,
|
61
|
-
"error" and "warning", and one event message. The numbers you assign here
|
62
|
-
create corresponding (though not identical) values in the header file that
|
63
|
-
is generated. It is the values found in the header file that you pass to the
|
64
|
-
EventLog#report_event method for the category or event id. Here's the
|
65
|
-
relevant data from the foo.h file (using foo.mc above):
|
66
|
-
|
67
|
-
#define CATEGORY_ERROR 0x00000001L
|
68
|
-
#define CATEGORY_WARNING 0x00000002L
|
69
|
-
#define FOO_ERROR 0xC0000003L
|
70
|
-
|
71
|
-
In the case of categories, that number is the name number that shows up in the
|
72
|
-
"category" field in the Event Viewer. In the case of event message files, it
|
73
|
-
is the text that shows up in the event description.
|
74
|
-
|
75
|
-
The "data" field is what replaces "%1" as an actual text string in the event
|
76
|
-
log, sort of like a printf format specifier, except that it's always a string.
|
77
|
-
|
78
|
-
== Registering an event source
|
79
|
-
First, create the .dll file from the .mc file. Then register that .dll file
|
80
|
-
for an event source we'll call "foo". You can name the .dll file anything
|
81
|
-
you like, but for sanity's sake I recommend keeping the same as the event
|
82
|
-
source name.
|
83
|
-
|
84
|
-
require 'win32/eventlog'
|
85
|
-
include Win32
|
86
|
-
|
87
|
-
dll_file = 'c:\\wherever\\foo.dll'
|
88
|
-
|
89
|
-
EventLog.add_event_source(
|
90
|
-
:source => 'Application',
|
91
|
-
:key_name => 'foo',
|
92
|
-
:category_count => 2,
|
93
|
-
:event_message_file => dll_file,
|
94
|
-
:category_message_file => dll_file
|
95
|
-
)
|
96
|
-
|
97
|
-
After you run this, you can run 'regedit' and see that your event source has
|
98
|
-
been inserted into the registry. You can find it under:
|
99
|
-
|
100
|
-
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application.
|
101
|
-
|
102
|
-
== Writing to the event source
|
103
|
-
Now that our event source 'foo' is registered, we can begin writing event
|
104
|
-
log data for it. Here's an example of how you use it:
|
105
|
-
|
106
|
-
require 'win32/eventlog'
|
107
|
-
include Win32
|
108
|
-
|
109
|
-
EventLog.open('Application') do |log|
|
110
|
-
log.report_event(
|
111
|
-
:source => 'foo',
|
112
|
-
:event_type => EventLog::WARN,
|
113
|
-
:category => '0x00000002L'.hex,
|
114
|
-
:event_id => '0x00000003L'.hex,
|
115
|
-
:data => 'I'm warning you!'
|
116
|
-
)
|
117
|
-
end
|
118
|
-
|
119
|
-
Note the values used for the 'category' and 'event_id' keys. Those are the
|
120
|
-
values that were generated automatically in the foo.h file that I showed you
|
121
|
-
above. You'll have to manually inspect the header file that's generated to
|
122
|
-
determine which values you should be using.
|
123
|
-
|
124
|
-
You can now open your event log viewer and look at the message. You can get
|
125
|
-
to your event log viewer via Start -> Control Panel -> Administrative Tools ->
|
126
|
-
Event Viewer. You should see a warning message with the category "warning"
|
127
|
-
and an event id of '3'. If you right click on that entry and select
|
128
|
-
"properties", you can see the event description is "Warning: I'm warning you!".
|
129
|
-
|
130
|
-
== More Info
|
131
|
-
For more information visit the following URL's:
|
132
|
-
|
133
|
-
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tools/tools/message_text_file_syntax.asp
|
134
|
-
|
135
|
-
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/message_files.asp
|
136
|
-
|
1
|
+
== Information about Message Files
|
2
|
+
Each event source should register message files that contain description
|
3
|
+
strings for each event identifier, event category, and parameter. Register
|
4
|
+
these files in the EventMessageFile, CategoryMessageFile, and
|
5
|
+
ParameterMessageFile registry values for the event source.
|
6
|
+
|
7
|
+
You can create one message file that contains descriptions for the event
|
8
|
+
identifiers, categories, and parameters, or create three separate message
|
9
|
+
files. Several applications can share the same message file.
|
10
|
+
|
11
|
+
You should typically create message files as resource-only DLLs. They are
|
12
|
+
smaller and faster than ordinary DLLs.
|
13
|
+
|
14
|
+
== What does a .mc file look like?
|
15
|
+
|
16
|
+
A .mc file is just a plain text file that is parsed by the "mc" utility to
|
17
|
+
generate a header and, ultimately, a .dll file. Here is a quick sample.
|
18
|
+
Note that there must be a newline after the last '.' at the bottom.
|
19
|
+
The ';' character denotes a comment.
|
20
|
+
|
21
|
+
; foo.mc
|
22
|
+
MessageId=0x1
|
23
|
+
SymbolicName=CATEGORY_ERROR
|
24
|
+
Language=English
|
25
|
+
error
|
26
|
+
.
|
27
|
+
|
28
|
+
MessageId=0x2
|
29
|
+
SymbolicName=CATEGORY_WARNING
|
30
|
+
Language=English
|
31
|
+
warning
|
32
|
+
.
|
33
|
+
|
34
|
+
MessageId=0x3
|
35
|
+
Severity=Error
|
36
|
+
SymbolicName=FOO_ERROR
|
37
|
+
Language=English
|
38
|
+
Error: %1
|
39
|
+
.
|
40
|
+
|
41
|
+
== How to generate a .dll file from a .mc file
|
42
|
+
To turn this file into a .dll you have two options. The first is to use the
|
43
|
+
command line utilities. Follow these steps:
|
44
|
+
|
45
|
+
1) mc filename.mc
|
46
|
+
2) rc -r -fo filename.res filename.rc
|
47
|
+
3) link -dll -noentry -out:filename.dll filename.res
|
48
|
+
|
49
|
+
Your other option is to use the win32-mc library, which is a simple wrapper
|
50
|
+
for the above commands, and is included with this library. You now have a
|
51
|
+
dll that you can associate with your event source (i.e. the one you associate
|
52
|
+
with your application). You can also take a look at the C header file that
|
53
|
+
.mc generates and use that in your own extensions if you like.
|
54
|
+
|
55
|
+
After this you'll need to register your event source and associate the .dll
|
56
|
+
file with it. To do that, use the EventLog.add_event_source method. Be sure
|
57
|
+
to specify the number of categories manually - it is not calculated
|
58
|
+
automatically by the OS.
|
59
|
+
|
60
|
+
Returning to the .mc file, the example I used actually creates two categories,
|
61
|
+
"error" and "warning", and one event message. The numbers you assign here
|
62
|
+
create corresponding (though not identical) values in the header file that
|
63
|
+
is generated. It is the values found in the header file that you pass to the
|
64
|
+
EventLog#report_event method for the category or event id. Here's the
|
65
|
+
relevant data from the foo.h file (using foo.mc above):
|
66
|
+
|
67
|
+
#define CATEGORY_ERROR 0x00000001L
|
68
|
+
#define CATEGORY_WARNING 0x00000002L
|
69
|
+
#define FOO_ERROR 0xC0000003L
|
70
|
+
|
71
|
+
In the case of categories, that number is the name number that shows up in the
|
72
|
+
"category" field in the Event Viewer. In the case of event message files, it
|
73
|
+
is the text that shows up in the event description.
|
74
|
+
|
75
|
+
The "data" field is what replaces "%1" as an actual text string in the event
|
76
|
+
log, sort of like a printf format specifier, except that it's always a string.
|
77
|
+
|
78
|
+
== Registering an event source
|
79
|
+
First, create the .dll file from the .mc file. Then register that .dll file
|
80
|
+
for an event source we'll call "foo". You can name the .dll file anything
|
81
|
+
you like, but for sanity's sake I recommend keeping the same as the event
|
82
|
+
source name.
|
83
|
+
|
84
|
+
require 'win32/eventlog'
|
85
|
+
include Win32
|
86
|
+
|
87
|
+
dll_file = 'c:\\wherever\\foo.dll'
|
88
|
+
|
89
|
+
EventLog.add_event_source(
|
90
|
+
:source => 'Application',
|
91
|
+
:key_name => 'foo',
|
92
|
+
:category_count => 2,
|
93
|
+
:event_message_file => dll_file,
|
94
|
+
:category_message_file => dll_file
|
95
|
+
)
|
96
|
+
|
97
|
+
After you run this, you can run 'regedit' and see that your event source has
|
98
|
+
been inserted into the registry. You can find it under:
|
99
|
+
|
100
|
+
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application.
|
101
|
+
|
102
|
+
== Writing to the event source
|
103
|
+
Now that our event source 'foo' is registered, we can begin writing event
|
104
|
+
log data for it. Here's an example of how you use it:
|
105
|
+
|
106
|
+
require 'win32/eventlog'
|
107
|
+
include Win32
|
108
|
+
|
109
|
+
EventLog.open('Application') do |log|
|
110
|
+
log.report_event(
|
111
|
+
:source => 'foo',
|
112
|
+
:event_type => EventLog::WARN,
|
113
|
+
:category => '0x00000002L'.hex,
|
114
|
+
:event_id => '0x00000003L'.hex,
|
115
|
+
:data => 'I'm warning you!'
|
116
|
+
)
|
117
|
+
end
|
118
|
+
|
119
|
+
Note the values used for the 'category' and 'event_id' keys. Those are the
|
120
|
+
values that were generated automatically in the foo.h file that I showed you
|
121
|
+
above. You'll have to manually inspect the header file that's generated to
|
122
|
+
determine which values you should be using.
|
123
|
+
|
124
|
+
You can now open your event log viewer and look at the message. You can get
|
125
|
+
to your event log viewer via Start -> Control Panel -> Administrative Tools ->
|
126
|
+
Event Viewer. You should see a warning message with the category "warning"
|
127
|
+
and an event id of '3'. If you right click on that entry and select
|
128
|
+
"properties", you can see the event description is "Warning: I'm warning you!".
|
129
|
+
|
130
|
+
== More Info
|
131
|
+
For more information visit the following URL's:
|
132
|
+
|
133
|
+
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tools/tools/message_text_file_syntax.asp
|
134
|
+
|
135
|
+
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/message_files.asp
|
136
|
+
|
137
137
|
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tools/tools/header_section.asp
|