winevt_c 0.1.1 → 0.2.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/example/eventlog.rb +11 -2
- data/example/tailing.rb +13 -2
- data/ext/winevt/winevt.c +6 -737
- data/ext/winevt/winevt_bookmark.c +100 -0
- data/ext/winevt/winevt_c.h +65 -0
- data/ext/winevt/winevt_channel.c +103 -0
- data/ext/winevt/winevt_query.c +245 -0
- data/ext/winevt/winevt_subscribe.c +220 -0
- data/ext/winevt/winevt_utils.c +236 -0
- data/lib/winevt/version.rb +3 -3
- metadata +8 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 065eff4f692c925eba38647837fa8ebdb201fe9efcca9920f43c419b92d13742
|
|
4
|
+
data.tar.gz: 0a17a6aba45eb9e13c97cb1670518864c3bc4a7bd8b58c4abea8225ce76dee20
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: ab903dcbb5f8b9af4aa750dabebb77aed9f1ba0cc6aad46e61dbd9fb10f5343082e1ea6fc53443858337b77d8b20774764335c0f23eb9bd9446aac0d78b9efe1
|
|
7
|
+
data.tar.gz: 0a03974794ad7811a6e0187efb1f43615f48072a681e985c08a8596218c1cb17566d2e844d0fc11b5cb293c86a32cdc4190ea66d22b5dc986f6377c7bdaccc1a
|
data/example/eventlog.rb
CHANGED
|
@@ -1,7 +1,16 @@
|
|
|
1
1
|
require 'winevt'
|
|
2
|
+
require 'rexml/document'
|
|
2
3
|
|
|
3
4
|
@query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
|
|
4
5
|
|
|
5
|
-
@query.each do |eventlog|
|
|
6
|
-
|
|
6
|
+
@query.each do |eventlog, message|
|
|
7
|
+
doc = REXML::Document.new(eventlog)
|
|
8
|
+
nodes = []
|
|
9
|
+
REXML::XPath.each(doc, "/Event/EventData/Data") do |node|
|
|
10
|
+
nodes << node.text
|
|
11
|
+
end
|
|
12
|
+
message = message.gsub(/(%\d+)/, '\1$s')
|
|
13
|
+
message = sprintf(message, *nodes)
|
|
14
|
+
|
|
15
|
+
puts ({eventlog: eventlog, data: message})
|
|
7
16
|
end
|
data/example/tailing.rb
CHANGED
|
@@ -1,11 +1,22 @@
|
|
|
1
1
|
require 'winevt'
|
|
2
|
+
require 'rexml/document'
|
|
2
3
|
|
|
3
4
|
@subscribe = Winevt::EventLog::Subscribe.new
|
|
4
5
|
@subscribe.tail = true
|
|
5
|
-
@subscribe.subscribe("
|
|
6
|
+
@subscribe.subscribe("Security", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
|
|
6
7
|
while (1) do
|
|
7
8
|
if @subscribe.next
|
|
8
|
-
|
|
9
|
+
eventlog = @subscribe.render
|
|
10
|
+
message = @subscribe.message
|
|
11
|
+
doc = REXML::Document.new(eventlog)
|
|
12
|
+
nodes = []
|
|
13
|
+
REXML::XPath.each(doc, "/Event/EventData/Data") do |node|
|
|
14
|
+
nodes << node.text
|
|
15
|
+
end
|
|
16
|
+
message = message.gsub(/(%\d+)/, '\1$s')
|
|
17
|
+
message = sprintf(message, *nodes)
|
|
18
|
+
|
|
19
|
+
puts ({eventlog: eventlog, data: message})
|
|
9
20
|
else
|
|
10
21
|
printf(".")
|
|
11
22
|
sleep(1)
|