winevt_c 0.7.2 → 0.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1069bcfe57cfd91d05fcff1a7314929c01c675d30678b8a624c926eb0a91b09f
-  data.tar.gz: bea008c2cf452539b59a9d22800183797babcbb5158e5f6688dd3fd749dc4e3d
+  metadata.gz: 1a95471f55e9dee6e48a8836c27e360dc8f8abc8d8687106805702502586acb2
+  data.tar.gz: c64666d6e09ce6e5fb4eb04f2cd951eeae8d656b9e20efc70375503ca253c453
 SHA512:
-  metadata.gz: 81ef978d005e6c87607cc187509f8e5ae52b33b7687100148139b050c09d61cbb813fe1e77f8ccc0a02fa881d6a8066b6f7c959f45be3ff65c79e77b03dbd247
-  data.tar.gz: c27480331ce8d8cfab82cd00ef4bd940e3a4224076db6641e9bb49019a2d88dac2ee73790153a20cf2bbafa1db6844b876f59cb53c249251460b6eb97b895c99
+  metadata.gz: ea964c952d8dc9f2d05639309a7a04be8564e13f563b6fce60c6f6fbd70b35d91d28d9f1436e1e1baf88db5cf7d77e66f115d70ad6ea76c99afc5f6cf99044c3
+  data.tar.gz: c39eeeaa3cfdb4c90a526a5a2a2a7ebc5e217624b89f526b697ab65a07b02118f40b6e1fcd9ef533022d5312d43dee279b9bdca20aba93f5788fddf3fe7cfe8d

data/Rakefile

@@ -28,7 +28,7 @@ task 'gem:native' do
   # See RUBY_CC_VERSION in https://github.com/rake-compiler/rake-compiler-dock/blob/master/Dockerfile.mri
   RakeCompilerDock.sh <<-EOS
     gem install bundler yard --no-doc && bundle
-    rake cross native gem RUBY_CC_VERSION=2.4.0:2.5.0:2.6.0
+    rake cross native gem RUBY_CC_VERSION=2.4.0:2.5.0:2.6.0:2.7.0
 EOS
 end
 

data/example/eventlog.rb

@@ -2,6 +2,8 @@ require 'winevt'
 
 @query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
 
+@query.render_as_xml = true
+@query.preserve_qualifiers = true
 @query.each do |eventlog, message, string_inserts|
   puts ({eventlog: eventlog, data: message})
 end

data/example/rate_limit.rb

@@ -1,7 +1,7 @@
 require 'winevt'
 
 @subscribe = Winevt::EventLog::Subscribe.new
-@subscribe.tail = true
+@subscribe.read_existing_events = true
 @subscribe.rate_limit = 80
 @subscribe.subscribe(
   "Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"

data/example/tailing.rb

@@ -1,7 +1,9 @@
 require 'winevt'
 
 @subscribe = Winevt::EventLog::Subscribe.new
-@subscribe.tail = true
+@subscribe.read_existing_events = true
+@subscribe.preserve_qualifiers = true
+@subscribe.render_as_xml = true
 @subscribe.subscribe(
   "Security", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"
 )

data/ext/winevt/winevt_c.h

@@ -27,11 +27,14 @@ extern "C" {
 #endif /* __cplusplus */
 
 VALUE wstr_to_rb_str(UINT cp, const WCHAR* wstr, int clen);
+#if defined(__cplusplus)
+[[ noreturn ]]
+#endif /* __cplusplus */
 void  raise_system_error(VALUE error, DWORD errorCode);
 VALUE render_to_rb_str(EVT_HANDLE handle, DWORD flags);
 WCHAR* get_description(EVT_HANDLE handle);
 VALUE get_values(EVT_HANDLE handle);
-VALUE render_system_event(EVT_HANDLE handle);
+VALUE render_system_event(EVT_HANDLE handle, BOOL preserve_qualifiers);
 
 #ifdef __cplusplus
 }
@@ -66,6 +69,7 @@ struct WinevtQuery
   LONG offset;
   LONG timeout;
   BOOL renderAsXML;
+  BOOL preserveQualifiers;
 };
 
 #define SUBSCRIBE_ARRAY_SIZE 10
@@ -84,6 +88,7 @@ struct WinevtSubscribe
   time_t lastTime;
   DWORD currentRate;
   BOOL renderAsXML;
+  BOOL preserveQualifiers;
 };
 
 void Init_winevt_query(VALUE rb_cEventLog);

data/ext/winevt/winevt_query.c

@@ -94,6 +94,7 @@ rb_winevt_query_initialize(VALUE self, VALUE channel, VALUE xpath)
   winevtQuery->offset = 0L;
   winevtQuery->timeout = 0L;
   winevtQuery->renderAsXML = TRUE;
+  winevtQuery->preserveQualifiers = FALSE;
 
   ALLOCV_END(wchannelBuf);
   ALLOCV_END(wpathBuf);
@@ -212,7 +213,7 @@ rb_winevt_query_render(VALUE self, EVT_HANDLE event)
   if (winevtQuery->renderAsXML) {
     return render_to_rb_str(event, EvtRenderEventXml);
   } else {
-    return render_system_event(event);
+    return render_system_event(event, winevtQuery->preserveQualifiers);
   }
 }
 
@@ -394,6 +395,42 @@ rb_winevt_query_set_render_as_xml(VALUE self, VALUE rb_render_as_xml)
   return Qnil;
 }
 
+/*
+ * This method specifies whether preserving qualifiers key or not.
+ *
+ * @since 0.7.3
+ * @param rb_render_as_xml [Boolean]
+ */
+static VALUE
+rb_winevt_query_set_preserve_qualifiers(VALUE self, VALUE rb_preserve_qualifiers)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(
+    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  winevtQuery->preserveQualifiers = RTEST(rb_preserve_qualifiers);
+
+  return Qnil;
+}
+
+/*
+ * This method returns whether preserving qualifiers or not.
+ *
+ * @since 0.7.3
+ * @return [Integer]
+ */
+static VALUE
+rb_winevt_query_get_preserve_qualifiers_p(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(
+    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  return winevtQuery->preserveQualifiers ? Qtrue : Qfalse;
+}
+
 void
 Init_winevt_query(VALUE rb_cEventLog)
 {
@@ -451,4 +488,12 @@ Init_winevt_query(VALUE rb_cEventLog)
   rb_define_method(rb_cQuery, "each", rb_winevt_query_each, 0);
   rb_define_method(rb_cQuery, "render_as_xml?", rb_winevt_query_render_as_xml_p, 0);
   rb_define_method(rb_cQuery, "render_as_xml=", rb_winevt_query_set_render_as_xml, 1);
+  /*
+   * @since 0.7.3
+   */
+  rb_define_method(rb_cQuery, "preserve_qualifiers?", rb_winevt_query_get_preserve_qualifiers_p, 0);
+  /*
+   * @since 0.7.3
+   */
+  rb_define_method(rb_cQuery, "preserve_qualifiers=", rb_winevt_query_set_preserve_qualifiers, 1);
 }

data/ext/winevt/winevt_subscribe.c

@@ -89,6 +89,7 @@ rb_winevt_subscribe_initialize(VALUE self)
   winevtSubscribe->currentRate = 0;
   winevtSubscribe->renderAsXML = TRUE;
   winevtSubscribe->readExistingEvents = TRUE;
+  winevtSubscribe->preserveQualifiers = FALSE;
 
   return Qnil;
 }
@@ -339,7 +340,7 @@ rb_winevt_subscribe_render(VALUE self, EVT_HANDLE event)
   if (winevtSubscribe->renderAsXML) {
     return render_to_rb_str(event, EvtRenderEventXml);
   } else {
-    return render_system_event(event);
+    return render_system_event(event, winevtSubscribe->preserveQualifiers);
   }
 }
 
@@ -517,6 +518,42 @@ rb_winevt_subscribe_set_render_as_xml(VALUE self, VALUE rb_render_as_xml)
   return Qnil;
 }
 
+/*
+ * This method specifies whether preserving qualifiers key or not.
+ *
+ * @since 0.7.3
+ * @param rb_render_as_xml [Boolean]
+ */
+static VALUE
+rb_winevt_subscribe_set_preserve_qualifiers(VALUE self, VALUE rb_preserve_qualifiers)
+{
+  struct WinevtSubscribe* winevtSubscribe;
+
+  TypedData_Get_Struct(
+    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
+
+  winevtSubscribe->preserveQualifiers = RTEST(rb_preserve_qualifiers);
+
+  return Qnil;
+}
+
+/*
+ * This method returns whether preserving qualifiers or not.
+ *
+ * @since 0.7.3
+ * @return [Integer]
+ */
+static VALUE
+rb_winevt_subscribe_get_preserve_qualifiers_p(VALUE self)
+{
+  struct WinevtSubscribe* winevtSubscribe;
+
+  TypedData_Get_Struct(
+    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
+
+  return winevtSubscribe->preserveQualifiers ? Qtrue : Qfalse;
+}
+
 void
 Init_winevt_subscribe(VALUE rb_cEventLog)
 {
@@ -549,4 +586,14 @@ Init_winevt_subscribe(VALUE rb_cEventLog)
     rb_cSubscribe, "render_as_xml?", rb_winevt_subscribe_render_as_xml_p, 0);
   rb_define_method(
     rb_cSubscribe, "render_as_xml=", rb_winevt_subscribe_set_render_as_xml, 1);
+  /*
+   * @since 0.7.3
+   */
+  rb_define_method(
+    rb_cSubscribe, "preserve_qualifiers?", rb_winevt_subscribe_get_preserve_qualifiers_p, 0);
+  /*
+   * @since 0.7.3
+   */
+  rb_define_method(
+    rb_cSubscribe, "preserve_qualifiers=", rb_winevt_subscribe_set_preserve_qualifiers, 1);
 }

data/ext/winevt/winevt_utils.cpp

@@ -497,7 +497,7 @@ cleanup:
 }
 
 VALUE
-render_system_event(EVT_HANDLE hEvent)
+render_system_event(EVT_HANDLE hEvent, BOOL preserve_qualifiers)
 {
   DWORD status = ERROR_SUCCESS;
   EVT_HANDLE hContext = NULL;
@@ -572,11 +572,23 @@ render_system_event(EVT_HANDLE hEvent)
   }
 
   EventID = pRenderedValues[EvtSystemEventID].UInt16Val;
-  if (EvtVarTypeNull != pRenderedValues[EvtSystemQualifiers].Type) {
-    EventID = MAKELONG(pRenderedValues[EvtSystemEventID].UInt16Val,
-                       pRenderedValues[EvtSystemQualifiers].UInt16Val);
+  if (preserve_qualifiers) {
+    if (EvtVarTypeNull != pRenderedValues[EvtSystemQualifiers].Type) {
+      rb_hash_aset(hash, rb_str_new2("Qualifiers"),
+                   INT2NUM(pRenderedValues[EvtSystemQualifiers].UInt16Val));
+    } else {
+      rb_hash_aset(hash, rb_str_new2("Qualifiers"), rb_str_new2(""));
+    }
+
+    rb_hash_aset(hash, rb_str_new2("EventID"), INT2NUM(EventID));
+  } else {
+    if (EvtVarTypeNull != pRenderedValues[EvtSystemQualifiers].Type) {
+      EventID = MAKELONG(pRenderedValues[EvtSystemEventID].UInt16Val,
+                         pRenderedValues[EvtSystemQualifiers].UInt16Val);
+    }
+
+    rb_hash_aset(hash, rb_str_new2("EventID"), ULONG2NUM(EventID));
   }
-  rb_hash_aset(hash, rb_str_new2("EventID"), LONG2NUM(EventID));
 
   rb_hash_aset(hash,
                rb_str_new2("Version"),

data/lib/winevt/version.rb

@@ -1,3 +1,3 @@
 module Winevt
-  VERSION = "0.7.2"
+  VERSION = "0.7.3"
 end

data/winevt_c.gemspec

@@ -28,7 +28,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "bundler", [">= 1.16", "< 3"]
   spec.add_development_dependency "rake", "~> 12.0"
   spec.add_development_dependency "rake-compiler", "~> 1.0"
-  spec.add_development_dependency "rake-compiler-dock", "~> 0.7.2"
+  spec.add_development_dependency "rake-compiler-dock", "~> 1.0.0"
   spec.add_development_dependency "test-unit", "~> 3.2"
   spec.add_development_dependency "yard", "~> 0.9"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: winevt_c
 version: !ruby/object:Gem::Version
-  version: 0.7.2
+  version: 0.7.3
 platform: ruby
 authors:
 - Hiroshi Hatake
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-02-28 00:00:00.000000000 Z
+date: 2020-03-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -64,14 +64,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 1.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 1.0.0
 - !ruby/object:Gem::Dependency
   name: test-unit
   requirement: !ruby/object:Gem::Requirement