winevt_c 0.1.1-x86-mingw32 → 0.2.0-x86-mingw32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b6b5aad981795315f2447d7a3059ea6b8aa36cf876e928eeb48f8ac07359fae
-  data.tar.gz: 74b530f1abc6a1dd7c5bf8d92589c440a36edbeebefc91867e9ced2043032830
+  metadata.gz: 11e02f59f87ac51ad5e3c7e2eb6c4318565e4d1d56d513a22123f9925a8f4bdb
+  data.tar.gz: c74e8d7399611c0c65aeea7c334645b32245b6efe6190fb5ecaac87f99796cbb
 SHA512:
-  metadata.gz: b164bd8437b99a30da71c6b9b30daf702dfee0bb661c217761dc29212af75b8abf5f21489d48460585d6d57cfc92443ca92e45a8e4713452a74418572080b7f7
-  data.tar.gz: '049978f7001c998f7bb4447ab7b677c916cc12dc0be5420da5f6c98b8620af016295049eb7e2ff11042f1fd923a7d1691d52de52dc9e62468c17fae875f961af'
+  metadata.gz: fa17a5b1aa52d5eb547a852c33037a0aca1512c0f6a964e5d451ba01eaf08056cf24aca79d88b100e53388daeb94c22818299f66d76fd2019d120ce98e322393
+  data.tar.gz: 524022cb48449f1f902cf38632f1931c073826b2ac128a16f64af1f35dec39c7545a1114107ddcced7088401bd8655cbc2f19cc9524868482a83e07a5b766fcc

data/example/eventlog.rb

@@ -1,7 +1,16 @@
 require 'winevt'
+require 'rexml/document'
 
 @query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
 
-@query.each do |eventlog|
-  puts eventlog
+@query.each do |eventlog, message|
+  doc = REXML::Document.new(eventlog)
+  nodes = []
+  REXML::XPath.each(doc, "/Event/EventData/Data") do |node|
+    nodes << node.text
+  end
+  message = message.gsub(/(%\d+)/, '\1$s')
+  message = sprintf(message, *nodes)
+
+  puts ({eventlog: eventlog, data: message})
 end

data/example/tailing.rb

@@ -1,11 +1,22 @@
 require 'winevt'
+require 'rexml/document'
 
 @subscribe = Winevt::EventLog::Subscribe.new
 @subscribe.tail = true
-@subscribe.subscribe("Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
+@subscribe.subscribe("Security", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
 while (1) do
   if @subscribe.next
-    puts @subscribe.render
+    eventlog = @subscribe.render
+    message = @subscribe.message
+    doc = REXML::Document.new(eventlog)
+    nodes = []
+    REXML::XPath.each(doc, "/Event/EventData/Data") do |node|
+      nodes << node.text
+    end
+    message = message.gsub(/(%\d+)/, '\1$s')
+    message = sprintf(message, *nodes)
+
+    puts ({eventlog: eventlog, data: message})
   else
     printf(".")
     sleep(1)