winevt_c 0.8.0 → 0.9.3

data/ext/winevt/winevt_locale.c

@@ -1,68 +1,92 @@
-#include <winevt_c.h>
-
-static LocaleInfo localeInfoTable [] = {
-    { MAKELANGID(LANG_BULGARIAN,  SUBLANG_DEFAULT),              "bg_BG"},
-    { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_SIMPLIFIED),   "zh_CN"},
-    { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_TRADITIONAL),  "zh_TW"},
-    { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_HONGKONG),     "zh_HK"},
-    { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_SINGAPORE),    "zh_SG"},
-    { MAKELANGID(LANG_CROATIAN,   SUBLANG_DEFAULT),              "hr_HR"},
-    { MAKELANGID(LANG_CZECH,      SUBLANG_DEFAULT),              "cs_CZ"},
-    { MAKELANGID(LANG_DANISH,     SUBLANG_DEFAULT),              "da_DK"},
-    { MAKELANGID(LANG_DUTCH,      SUBLANG_DUTCH),                "nl_NL"},
-    { MAKELANGID(LANG_DUTCH,      SUBLANG_DUTCH_BELGIAN),        "nl_BE"},
-    { MAKELANGID(LANG_ENGLISH,    SUBLANG_DEFAULT),              "en_US"},
-    { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_UK),           "en_GB"},
-    { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_AUS),          "en_AU"},
-    { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_CAN),          "en_CA"},
-    { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_NZ),           "en_NZ"},
-    { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_EIRE),         "en_IE"},
-    { MAKELANGID(LANG_FINNISH,    SUBLANG_DEFAULT),              "fi_FI"},
-    { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH),               "fr_FR"},
-    { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH_BELGIAN),       "fr_BE"},
-    { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH_CANADIAN),      "fr_CA"},
-    { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH_SWISS),         "fr_CH"},
-    { MAKELANGID(LANG_GERMAN,     SUBLANG_GERMAN),               "de_DE"},
-    { MAKELANGID(LANG_GERMAN,     SUBLANG_GERMAN_SWISS),         "de_CH"},
-    { MAKELANGID(LANG_GERMAN,     SUBLANG_GERMAN_AUSTRIAN),      "de_AT"},
-    { MAKELANGID(LANG_GREEK,      SUBLANG_DEFAULT),              "el_GR"},
-    { MAKELANGID(LANG_HUNGARIAN,  SUBLANG_DEFAULT),              "hu_HU"},
-    { MAKELANGID(LANG_ICELANDIC,  SUBLANG_DEFAULT),              "is_IS"},
-    { MAKELANGID(LANG_ITALIAN,    SUBLANG_ITALIAN),              "it_IT"},
-    { MAKELANGID(LANG_ITALIAN,    SUBLANG_ITALIAN_SWISS),        "it_CH"},
-    { MAKELANGID(LANG_JAPANESE,   SUBLANG_DEFAULT),              "ja_JP"},
-    { MAKELANGID(LANG_KOREAN,     SUBLANG_DEFAULT),              "ko_KO"},
-    { MAKELANGID(LANG_NORWEGIAN,  SUBLANG_NORWEGIAN_BOKMAL),     "no_NO"},
-    { MAKELANGID(LANG_NORWEGIAN,  SUBLANG_NORWEGIAN_BOKMAL),     "nb_NO"},
-    { MAKELANGID(LANG_NORWEGIAN,  SUBLANG_NORWEGIAN_NYNORSK),    "nn_NO"},
-    { MAKELANGID(LANG_POLISH,     SUBLANG_DEFAULT),              "pl_PL"},
-    { MAKELANGID(LANG_PORTUGUESE, SUBLANG_PORTUGUESE),           "pt_PT"},
-    { MAKELANGID(LANG_PORTUGUESE, SUBLANG_PORTUGUESE_BRAZILIAN), "pt_BR"},
-    { MAKELANGID(LANG_ROMANIAN,   SUBLANG_DEFAULT),              "ro_RO"},
-    { MAKELANGID(LANG_RUSSIAN,    SUBLANG_DEFAULT),              "ru_RU"},
-    { MAKELANGID(LANG_SLOVAK,     SUBLANG_DEFAULT),              "sk_SK"},
-    { MAKELANGID(LANG_SLOVENIAN,  SUBLANG_DEFAULT),              "sl_SI"},
-    { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH),              "es_ES"},
-    { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH),              "es_ES_T"},
-    { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH_MEXICAN),      "es_MX"},
-    { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH_MODERN),       "es_ES_M"},
-    { MAKELANGID(LANG_SWEDISH,    SUBLANG_DEFAULT),              "sv_SE"},
-    { MAKELANGID(LANG_TURKISH,    SUBLANG_DEFAULT),              "tr_TR"},
-    { 0, NULL}
-};
-
-LocaleInfo default_locale = {MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), "neutral"};
-
-LocaleInfo*
-get_locale_from_rb_str(VALUE rb_locale_str)
-{
-  CHAR* locale_str = StringValuePtr(rb_locale_str);
-
-  for (int i = 0; localeInfoTable[i].langCode != NULL; i++) {
-    if (stricmp(localeInfoTable[i].langCode, locale_str) == 0) {
-      return &localeInfoTable[i];
-    }
-  }
-
-  rb_raise(rb_eArgError, "Unknown locale: %s", locale_str);
-}
+#include <winevt_c.h>
+
+
+/* clang-format off */
+/*
+ * Document-class: Winevt::EventLog::Locale
+ *
+ * handle locales for Windows EventLog's description.
+ *
+ * @example
+ *  require 'winevt'
+ *
+ *  @locale = Winevt::EventLog::Locale.new
+ *  @locale.each {|code, desc|
+ *    print code, desc
+ *  }
+ * @since v0.8.1
+ */
+/* clang-format on */
+
+VALUE rb_cLocale;
+
+static void locale_free(void* ptr);
+
+static const rb_data_type_t rb_winevt_locale_type = { "winevt/locale",
+                                                       {
+                                                         0,
+                                                         locale_free,
+                                                         0,
+                                                       },
+                                                       NULL,
+                                                       NULL,
+                                                       RUBY_TYPED_FREE_IMMEDIATELY };
+
+static void
+locale_free(void* ptr)
+{
+  xfree(ptr);
+}
+
+static VALUE
+rb_winevt_locale_alloc(VALUE klass)
+{
+  VALUE obj;
+  struct WinevtLocale* winevtLocale;
+  obj = TypedData_Make_Struct(
+    klass, struct WinevtLocale, &rb_winevt_locale_type, winevtLocale);
+  return obj;
+}
+
+/*
+ * Initalize Locale class.
+ *
+ * @return [Locale]
+ *
+ */
+static VALUE
+rb_winevt_locale_initialize(VALUE self)
+{
+  return Qnil;
+}
+
+/*
+ * Enumerate supported locales and its descriptions
+ *
+ * @yield (String, String)
+ *
+ */
+static VALUE
+rb_winevt_locale_each(VALUE self)
+{
+  RETURN_ENUMERATOR(self, 0, 0);
+
+  for (int i = 0; localeInfoTable[i].langCode != NULL; i++) {
+    rb_yield_values(2,
+                    rb_utf8_str_new_cstr(localeInfoTable[i].langCode),
+                    rb_utf8_str_new_cstr(localeInfoTable[i].description));
+  }
+
+  return Qnil;
+}
+
+void
+Init_winevt_locale(VALUE rb_cEventLog)
+{
+  rb_cLocale = rb_define_class_under(rb_cEventLog, "Locale", rb_cObject);
+
+  rb_define_alloc_func(rb_cLocale, rb_winevt_locale_alloc);
+
+  rb_define_method(rb_cLocale, "initialize", rb_winevt_locale_initialize, 0);
+  rb_define_method(rb_cLocale, "each", rb_winevt_locale_each, 0);
+}

data/ext/winevt/winevt_locale_info.c

@@ -0,0 +1,68 @@
+#include <winevt_c.h>
+
+LocaleInfo localeInfoTable [] = {
+  { MAKELANGID(LANG_BULGARIAN,  SUBLANG_DEFAULT),              "bg_BG",   "Bulgarian"},
+  { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_SIMPLIFIED),   "zh_CN",   "Simplified Chinese "},
+  { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_TRADITIONAL),  "zh_TW",   "Traditional Chinese"},
+  { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_HONGKONG),     "zh_HK",   "Chinese (Hong Kong)"},
+  { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_SINGAPORE),    "zh_SG",   "Chinese (Singapore)"},
+  { MAKELANGID(LANG_CROATIAN,   SUBLANG_DEFAULT),              "hr_HR",   "Croatian"},
+  { MAKELANGID(LANG_CZECH,      SUBLANG_DEFAULT),              "cs_CZ",   "Czech"},
+  { MAKELANGID(LANG_DANISH,     SUBLANG_DEFAULT),              "da_DK",   "Dannish"},
+  { MAKELANGID(LANG_DUTCH,      SUBLANG_DUTCH),                "nl_NL",   "Dutch"},
+  { MAKELANGID(LANG_DUTCH,      SUBLANG_DUTCH_BELGIAN),        "nl_BE",   "Dutch (Belgium)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_DEFAULT),              "en_US",   "English (United States)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_UK),           "en_GB",   "English (UK)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_AUS),          "en_AU",   "English (Australia)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_CAN),          "en_CA",   "English (Canada)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_NZ),           "en_NZ",   "English (New Zealand)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_EIRE),         "en_IE",   "English (Ireland)"},
+  { MAKELANGID(LANG_FINNISH,    SUBLANG_DEFAULT),              "fi_FI",   "Finnish"},
+  { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH),               "fr_FR",   "French"},
+  { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH_BELGIAN),       "fr_BE",   "French (Belgium)"},
+  { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH_CANADIAN),      "fr_CA",   "French (Canada)"},
+  { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH_SWISS),         "fr_CH",   "French (Swiss)"},
+  { MAKELANGID(LANG_GERMAN,     SUBLANG_GERMAN),               "de_DE",   "German"},
+  { MAKELANGID(LANG_GERMAN,     SUBLANG_GERMAN_SWISS),         "de_CH",   "German (Swiss)"},
+  { MAKELANGID(LANG_GERMAN,     SUBLANG_GERMAN_AUSTRIAN),      "de_AT",   "German (Austria))"},
+  { MAKELANGID(LANG_GREEK,      SUBLANG_DEFAULT),              "el_GR",   "Greek (Ελληνικά)"},
+  { MAKELANGID(LANG_HUNGARIAN,  SUBLANG_DEFAULT),              "hu_HU",   "Hungarian"},
+  { MAKELANGID(LANG_ICELANDIC,  SUBLANG_DEFAULT),              "is_IS",   "Icelandic"},
+  { MAKELANGID(LANG_ITALIAN,    SUBLANG_ITALIAN),              "it_IT",   "Italian (Italy)"},
+  { MAKELANGID(LANG_ITALIAN,    SUBLANG_ITALIAN_SWISS),        "it_CH",   "Italian (Swiss)"},
+  { MAKELANGID(LANG_JAPANESE,   SUBLANG_DEFAULT),              "ja_JP",   "Japanases"},
+  { MAKELANGID(LANG_KOREAN,     SUBLANG_DEFAULT),              "ko_KO",   "Korean"},
+  { MAKELANGID(LANG_NORWEGIAN,  SUBLANG_NORWEGIAN_BOKMAL),     "no_NO",   "Norwegian (Bokmål)"},
+  { MAKELANGID(LANG_NORWEGIAN,  SUBLANG_NORWEGIAN_BOKMAL),     "nb_NO",   "Norwegian (Bokmål)"},
+  { MAKELANGID(LANG_NORWEGIAN,  SUBLANG_NORWEGIAN_NYNORSK),    "nn_NO",   "Norwegian (Nynorsk)"},
+  { MAKELANGID(LANG_POLISH,     SUBLANG_DEFAULT),              "pl_PL",   "Polish"},
+  { MAKELANGID(LANG_PORTUGUESE, SUBLANG_PORTUGUESE),           "pt_PT",   "Portuguese"},
+  { MAKELANGID(LANG_PORTUGUESE, SUBLANG_PORTUGUESE_BRAZILIAN), "pt_BR",   "Portuguese (Brazil)"},
+  { MAKELANGID(LANG_ROMANIAN,   SUBLANG_DEFAULT),              "ro_RO",   "Romanian"},
+  { MAKELANGID(LANG_RUSSIAN,    SUBLANG_DEFAULT),              "ru_RU",   "Russian  (русский язык)"},
+  { MAKELANGID(LANG_SLOVAK,     SUBLANG_DEFAULT),              "sk_SK",   "Slovak"},
+  { MAKELANGID(LANG_SLOVENIAN,  SUBLANG_DEFAULT),              "sl_SI",   "Slovenian"},
+  { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH),              "es_ES",   "Spanish"},
+  { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH),              "es_ES_T", "Spanish (Traditional)"},
+  { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH_MEXICAN),      "es_MX",   "Spanish (Mexico)"},
+  { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH_MODERN),       "es_ES_M", "Spanish (Modern)"},
+  { MAKELANGID(LANG_SWEDISH,    SUBLANG_DEFAULT),              "sv_SE",   "Swedish"},
+  { MAKELANGID(LANG_TURKISH,    SUBLANG_DEFAULT),              "tr_TR",   "Turkish"},
+  { 0, NULL, NULL}
+};
+
+LocaleInfo default_locale = {MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), "neutral", "Default"};
+
+LocaleInfo*
+get_locale_info_from_rb_str(VALUE rb_locale_str)
+{
+  CHAR* locale_str = StringValuePtr(rb_locale_str);
+
+  for (int i = 0; localeInfoTable[i].langCode != NULL; i++) {
+    if (stricmp(localeInfoTable[i].langCode, locale_str) == 0) {
+      return &localeInfoTable[i];
+    }
+  }
+
+  rb_raise(rb_eArgError, "Unknown locale: %s", locale_str);
+}

data/ext/winevt/winevt_query.c

@@ -1,551 +1,649 @@
-#include <winevt_c.h>
-
-/* clang-format off */
-/*
- * Document-class: Winevt::EventLog::Query
- *
- * Query Windows EventLog channel.
- *
- * @example
- *  require 'winevt'
- *
- *  @query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
- *
- *  @query.each do |eventlog, message, string_inserts|
- *    puts ({eventlog: eventlog, data: message})
- *  end
- */
-/* clang-format on */
-
-VALUE rb_cFlag;
-
-static void query_free(void* ptr);
-
-static const rb_data_type_t rb_winevt_query_type = { "winevt/query",
-                                                     {
-                                                       0,
-                                                       query_free,
-                                                       0,
-                                                     },
-                                                     NULL,
-                                                     NULL,
-                                                     RUBY_TYPED_FREE_IMMEDIATELY };
-
-static void
-query_free(void* ptr)
-{
-  struct WinevtQuery* winevtQuery = (struct WinevtQuery*)ptr;
-  if (winevtQuery->query)
-    EvtClose(winevtQuery->query);
-
-  for (int i = 0; i < winevtQuery->count; i++) {
-    if (winevtQuery->hEvents[i])
-      EvtClose(winevtQuery->hEvents[i]);
-  }
-  xfree(ptr);
-}
-
-static VALUE
-rb_winevt_query_alloc(VALUE klass)
-{
-  VALUE obj;
-  struct WinevtQuery* winevtQuery;
-  obj =
-    TypedData_Make_Struct(klass, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-  return obj;
-}
-
-/*
- * Initalize Query class.
- *
- * @param channel [String] Querying EventLog channel.
- * @param xpath [String] Querying XPath.
- * @return [Query]
- *
- */
-static VALUE
-rb_winevt_query_initialize(VALUE self, VALUE channel, VALUE xpath)
-{
-  PWSTR evtChannel, evtXPath;
-  struct WinevtQuery* winevtQuery;
-  DWORD len;
-  VALUE wchannelBuf, wpathBuf;
-
-  Check_Type(channel, T_STRING);
-  Check_Type(xpath, T_STRING);
-
-  // channel : To wide char
-  len =
-    MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(channel), RSTRING_LEN(channel), NULL, 0);
-  evtChannel = ALLOCV_N(WCHAR, wchannelBuf, len + 1);
-  MultiByteToWideChar(
-    CP_UTF8, 0, RSTRING_PTR(channel), RSTRING_LEN(channel), evtChannel, len);
-  evtChannel[len] = L'\0';
-
-  // xpath : To wide char
-  len = MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(xpath), RSTRING_LEN(xpath), NULL, 0);
-  evtXPath = ALLOCV_N(WCHAR, wpathBuf, len + 1);
-  MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(xpath), RSTRING_LEN(xpath), evtXPath, len);
-  evtXPath[len] = L'\0';
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  winevtQuery->query = EvtQuery(
-    NULL, evtChannel, evtXPath, EvtQueryChannelPath | EvtQueryTolerateQueryErrors);
-  winevtQuery->offset = 0L;
-  winevtQuery->timeout = 0L;
-  winevtQuery->renderAsXML = TRUE;
-  winevtQuery->preserveQualifiers = FALSE;
-  winevtQuery->localeInfo = &default_locale;
-
-  ALLOCV_END(wchannelBuf);
-  ALLOCV_END(wpathBuf);
-
-  return Qnil;
-}
-
-/*
- * This method returns querying event offset.
- *
- * @return [Integer]
- */
-static VALUE
-rb_winevt_query_get_offset(VALUE self)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  return LONG2NUM(winevtQuery->offset);
-}
-
-/*
- * This method specifies querying event offset.
- *
- * @param offset [Integer] offset value
- */
-static VALUE
-rb_winevt_query_set_offset(VALUE self, VALUE offset)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  winevtQuery->offset = NUM2LONG(offset);
-
-  return Qnil;
-}
-
-/*
- * This method returns timeout value.
- *
- * @return [Integer]
- */
-static VALUE
-rb_winevt_query_get_timeout(VALUE self)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  return LONG2NUM(winevtQuery->timeout);
-}
-
-/*
- * This method specifies timeout value.
- *
- * @param timeout [Integer] timeout value
- */
-static VALUE
-rb_winevt_query_set_timeout(VALUE self, VALUE timeout)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  winevtQuery->timeout = NUM2LONG(timeout);
-
-  return Qnil;
-}
-
-/*
- * Handle the next values. Since v0.6.0, this method is used for
- * testing only. Please use #each instead.
- *
- * @return [Boolean]
- *
- * @see each
- */
-static VALUE
-rb_winevt_query_next(VALUE self)
-{
-  EVT_HANDLE hEvents[QUERY_ARRAY_SIZE];
-  ULONG count;
-  DWORD status = ERROR_SUCCESS;
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  if (!EvtNext(winevtQuery->query, QUERY_ARRAY_SIZE, hEvents, INFINITE, 0, &count)) {
-    status = GetLastError();
-    if (ERROR_NO_MORE_ITEMS != status) {
-      return Qfalse;
-    }
-  }
-
-  if (status == ERROR_SUCCESS) {
-    winevtQuery->count = count;
-    for (int i = 0; i < count; i++) {
-      winevtQuery->hEvents[i] = hEvents[i];
-    }
-
-    return Qtrue;
-  }
-
-  return Qfalse;
-}
-
-static VALUE
-rb_winevt_query_render(VALUE self, EVT_HANDLE event)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  if (winevtQuery->renderAsXML) {
-    return render_to_rb_str(event, EvtRenderEventXml);
-  } else {
-    return render_system_event(event, winevtQuery->preserveQualifiers);
-  }
-}
-
-static VALUE
-rb_winevt_query_message(EVT_HANDLE event, LocaleInfo* localeInfo)
-{
-  WCHAR* wResult;
-  VALUE utf8str;
-
-  wResult = get_description(event, localeInfo->langID);
-  utf8str = wstr_to_rb_str(CP_UTF8, wResult, -1);
-  free(wResult);
-
-  return utf8str;
-}
-
-static VALUE
-rb_winevt_query_string_inserts(EVT_HANDLE event)
-{
-  return get_values(event);
-}
-
-static DWORD
-get_evt_seek_flag_from_cstr(char* flag_str)
-{
-  if (strcmp(flag_str, "first") == 0)
-    return EvtSeekRelativeToFirst;
-  else if (strcmp(flag_str, "last") == 0)
-    return EvtSeekRelativeToLast;
-  else if (strcmp(flag_str, "current") == 0)
-    return EvtSeekRelativeToCurrent;
-  else if (strcmp(flag_str, "bookmark") == 0)
-    return EvtSeekRelativeToBookmark;
-  else if (strcmp(flag_str, "originmask") == 0)
-    return EvtSeekOriginMask;
-  else if (strcmp(flag_str, "strict") == 0)
-    return EvtSeekStrict;
-  else
-    rb_raise(rb_eArgError, "Unknown seek flag: %s", flag_str);
-
-  return 0;
-}
-
-/*
- * This method specifies seek strategy.
- *
- * @param bookmark_or_flag [Bookmark|Query::Flag]
- * @return [Boolean]
- */
-static VALUE
-rb_winevt_query_seek(VALUE self, VALUE bookmark_or_flag)
-{
-  struct WinevtQuery* winevtQuery;
-  struct WinevtBookmark* winevtBookmark = NULL;
-  DWORD flag = 0;
-
-  switch (TYPE(bookmark_or_flag)) {
-    case T_SYMBOL:
-      flag = get_evt_seek_flag_from_cstr(RSTRING_PTR(rb_sym2str(bookmark_or_flag)));
-      break;
-    case T_STRING:
-      flag = get_evt_seek_flag_from_cstr(StringValueCStr(bookmark_or_flag));
-      break;
-    case T_FIXNUM:
-      flag = NUM2LONG(bookmark_or_flag);
-      break;
-    default:
-      if (!rb_obj_is_kind_of(bookmark_or_flag, rb_cBookmark))
-        rb_raise(rb_eArgError, "Expected a String or a Symbol or a Bookmark instance");
-
-      winevtBookmark = EventBookMark(bookmark_or_flag);
-  }
-
-  if (winevtBookmark) {
-    TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-    if (EvtSeek(winevtQuery->query,
-                winevtQuery->offset,
-                winevtBookmark->bookmark,
-                winevtQuery->timeout,
-                EvtSeekRelativeToBookmark))
-      return Qtrue;
-  } else {
-    TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-    if (EvtSeek(
-          winevtQuery->query, winevtQuery->offset, NULL, winevtQuery->timeout, flag)) {
-      return Qtrue;
-    }
-  }
-
-  return Qfalse;
-}
-
-static VALUE
-rb_winevt_query_close_handle(VALUE self)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  for (int i = 0; i < winevtQuery->count; i++) {
-    if (winevtQuery->hEvents[i] != NULL) {
-      EvtClose(winevtQuery->hEvents[i]);
-      winevtQuery->hEvents[i] = NULL;
-    }
-  }
-
-  return Qnil;
-}
-
-static VALUE
-rb_winevt_query_each_yield(VALUE self)
-{
-  RETURN_ENUMERATOR(self, 0, 0);
-
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  for (int i = 0; i < winevtQuery->count; i++) {
-    rb_yield_values(3,
-                    rb_winevt_query_render(self, winevtQuery->hEvents[i]),
-                    rb_winevt_query_message(winevtQuery->hEvents[i], winevtQuery->localeInfo),
-                    rb_winevt_query_string_inserts(winevtQuery->hEvents[i]));
-  }
-  return Qnil;
-}
-
-/*
- * Enumerate to obtain Windows EventLog contents.
- *
- * This method yields the following:
- * (Stringified EventLog, Stringified detail message, Stringified
- * insert values)
- *
- * @yield (String,String,String)
- *
- */
-static VALUE
-rb_winevt_query_each(VALUE self)
-{
-  RETURN_ENUMERATOR(self, 0, 0);
-
-  while (rb_winevt_query_next(self)) {
-    rb_ensure(rb_winevt_query_each_yield, self, rb_winevt_query_close_handle, self);
-  }
-
-  return Qnil;
-}
-
-/*
- * This method returns whether render as xml or not.
- *
- * @return [Boolean]
- */
-static VALUE
-rb_winevt_query_render_as_xml_p(VALUE self)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  return winevtQuery->renderAsXML ? Qtrue : Qfalse;
-}
-
-/*
- * This method specifies whether render as xml or not.
- *
- * @param rb_render_as_xml [Boolean]
- */
-static VALUE
-rb_winevt_query_set_render_as_xml(VALUE self, VALUE rb_render_as_xml)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  winevtQuery->renderAsXML = RTEST(rb_render_as_xml);
-
-  return Qnil;
-}
-
-/*
- * This method specifies whether preserving qualifiers key or not.
- *
- * @since 0.7.3
- * @param rb_render_as_xml [Boolean]
- */
-static VALUE
-rb_winevt_query_set_preserve_qualifiers(VALUE self, VALUE rb_preserve_qualifiers)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(
-    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  winevtQuery->preserveQualifiers = RTEST(rb_preserve_qualifiers);
-
-  return Qnil;
-}
-
-/*
- * This method returns whether preserving qualifiers or not.
- *
- * @since 0.7.3
- * @return [Integer]
- */
-static VALUE
-rb_winevt_query_get_preserve_qualifiers_p(VALUE self)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(
-    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  return winevtQuery->preserveQualifiers ? Qtrue : Qfalse;
-}
-
-/*
- * This method specifies locale with [String].
- *
- * @since 0.8.0
- * @param rb_locale_str [String]
- */
-static VALUE
-rb_winevt_query_set_locale(VALUE self, VALUE rb_locale_str)
-{
-  struct WinevtQuery* winevtQuery;
-  LocaleInfo* locale_info = &default_locale;
-
-  TypedData_Get_Struct(
-    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  locale_info = get_locale_from_rb_str(rb_locale_str);
-
-  winevtQuery->localeInfo = locale_info;
-
-  return Qnil;
-}
-
-/*
- * This method obtains specified locale with [String].
- *
- * @since 0.8.0
- */
-static VALUE
-rb_winevt_query_get_locale(VALUE self)
-{
-  struct WinevtQuery* winevtQuery;
-
-  TypedData_Get_Struct(
-    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-
-  if (winevtQuery->localeInfo->langCode) {
-    return rb_str_new2(winevtQuery->localeInfo->langCode);
-  } else {
-    return rb_str_new2(default_locale.langCode);
-  }
-}
-
-void
-Init_winevt_query(VALUE rb_cEventLog)
-{
-  rb_cQuery = rb_define_class_under(rb_cEventLog, "Query", rb_cObject);
-  rb_define_alloc_func(rb_cQuery, rb_winevt_query_alloc);
-
-  rb_cFlag = rb_define_module_under(rb_cQuery, "Flag");
-
-  /* clang-format off */
-  /*
-   * EVT_SEEK_FLAGS enumeration: EvtSeekRelativeToFirst
-   * @since 0.6.0
-   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekRelativeToFirst
-   */
-  rb_define_const(rb_cFlag, "RelativeToFirst", LONG2NUM(EvtSeekRelativeToFirst));
-  /*
-   * EVT_SEEK_FLAGS enumeration: EvtSeekRelativeToLast
-   * @since 0.6.0
-   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekRelativeToLast
-   */
-  rb_define_const(rb_cFlag, "RelativeToLast", LONG2NUM(EvtSeekRelativeToLast));
-  /*
-   * EVT_SEEK_FLAGS enumeration: EvtSeekRelativeToCurrent
-   * @since 0.6.0
-   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekRelativeToCurrent
-   */
-  rb_define_const(rb_cFlag, "RelativeToCurrent", LONG2NUM(EvtSeekRelativeToCurrent));
-  /*
-   * EVT_SEEK_FLAGS enumeration: EvtSeekRelativeToBookmark
-   * @since 0.6.0
-   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekRelativeToBookmark
-   */
-  rb_define_const(rb_cFlag, "RelativeToBookmark", LONG2NUM(EvtSeekRelativeToBookmark));
-  /*
-   * EVT_SEEK_FLAGS enumeration: EvtSeekOriginMask
-   * @since 0.6.0
-   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekOriginMask
-   */
-  rb_define_const(rb_cFlag, "OriginMask", LONG2NUM(EvtSeekOriginMask));
-  /*
-   * EVT_SEEK_FLAGS enumeration: EvtSeekStrict
-   * @since 0.6.0
-   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekStrict
-   */
-  rb_define_const(rb_cFlag, "Strict", LONG2NUM(EvtSeekStrict));
-  /* clang-format on */
-
-  rb_define_method(rb_cQuery, "initialize", rb_winevt_query_initialize, 2);
-  rb_define_method(rb_cQuery, "next", rb_winevt_query_next, 0);
-  rb_define_method(rb_cQuery, "seek", rb_winevt_query_seek, 1);
-  rb_define_method(rb_cQuery, "offset", rb_winevt_query_get_offset, 0);
-  rb_define_method(rb_cQuery, "offset=", rb_winevt_query_set_offset, 1);
-  rb_define_method(rb_cQuery, "timeout", rb_winevt_query_get_timeout, 0);
-  rb_define_method(rb_cQuery, "timeout=", rb_winevt_query_set_timeout, 1);
-  rb_define_method(rb_cQuery, "each", rb_winevt_query_each, 0);
-  rb_define_method(rb_cQuery, "render_as_xml?", rb_winevt_query_render_as_xml_p, 0);
-  rb_define_method(rb_cQuery, "render_as_xml=", rb_winevt_query_set_render_as_xml, 1);
-  /*
-   * @since 0.7.3
-   */
-  rb_define_method(rb_cQuery, "preserve_qualifiers?", rb_winevt_query_get_preserve_qualifiers_p, 0);
-  /*
-   * @since 0.7.3
-   */
-  rb_define_method(rb_cQuery, "preserve_qualifiers=", rb_winevt_query_set_preserve_qualifiers, 1);
-  /*
-   * @since 0.8.0
-   */
-  rb_define_method(rb_cQuery, "locale", rb_winevt_query_get_locale, 0);
-  /*
-   * @since 0.8.0
-   */
-  rb_define_method(rb_cQuery, "locale=", rb_winevt_query_set_locale, 1);
-}
+#include <winevt_c.h>
+
+/* clang-format off */
+/*
+ * Document-class: Winevt::EventLog::Query
+ *
+ * Query Windows EventLog channel.
+ *
+ * @example
+ *  require 'winevt'
+ *
+ *  @query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
+ *
+ *  @query.each do |eventlog, message, string_inserts|
+ *    puts ({eventlog: eventlog, data: message})
+ *  end
+ */
+/* clang-format on */
+
+VALUE rb_cFlag;
+
+static void query_free(void* ptr);
+
+static const rb_data_type_t rb_winevt_query_type = { "winevt/query",
+                                                     {
+                                                       0,
+                                                       query_free,
+                                                       0,
+                                                     },
+                                                     NULL,
+                                                     NULL,
+                                                     RUBY_TYPED_FREE_IMMEDIATELY };
+
+static void
+close_handles(struct WinevtQuery* winevtQuery)
+{
+  if (winevtQuery->query) {
+    EvtClose(winevtQuery->query);
+    winevtQuery->query = NULL;
+  }
+
+  for (int i = 0; i < winevtQuery->count; i++) {
+    if (winevtQuery->hEvents[i]) {
+      EvtClose(winevtQuery->hEvents[i]);
+      winevtQuery->hEvents[i] = NULL;
+    }
+  }
+
+  if (winevtQuery->remoteHandle) {
+    EvtClose(winevtQuery->remoteHandle);
+    winevtQuery->remoteHandle = NULL;
+  }
+}
+
+static void
+query_free(void* ptr)
+{
+  struct WinevtQuery* winevtQuery = (struct WinevtQuery*)ptr;
+  close_handles(winevtQuery);
+
+  xfree(ptr);
+}
+
+static VALUE
+rb_winevt_query_alloc(VALUE klass)
+{
+  VALUE obj;
+  struct WinevtQuery* winevtQuery;
+  obj =
+    TypedData_Make_Struct(klass, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+  return obj;
+}
+
+/*
+ * Initalize Query class.
+ *
+ * @overload initialize(channel, xpath, session=nil)
+ *   @param channel [String] Querying EventLog channel.
+ *   @param xpath [String] Querying XPath.
+ *   @param session [Session] Session information for remoting access.
+ * @return [Query]
+ *
+ */
+static VALUE
+rb_winevt_query_initialize(VALUE argc, VALUE *argv, VALUE self)
+{
+  PWSTR evtChannel, evtXPath;
+  VALUE channel, xpath, session;
+  struct WinevtQuery* winevtQuery;
+  struct WinevtSession* winevtSession;
+  EVT_HANDLE hRemoteHandle = NULL;
+  DWORD len;
+  VALUE wchannelBuf, wpathBuf;
+  DWORD err = ERROR_SUCCESS;
+
+  rb_scan_args(argc, argv, "21", &channel, &xpath, &session);
+  Check_Type(channel, T_STRING);
+  Check_Type(xpath, T_STRING);
+
+  if (rb_obj_is_kind_of(session, rb_cSession)) {
+    winevtSession = EventSession(session);
+
+    hRemoteHandle = connect_to_remote(winevtSession->server,
+                                      winevtSession->domain,
+                                      winevtSession->username,
+                                      winevtSession->password,
+                                      winevtSession->flags,
+                                      &err);
+    if (err != ERROR_SUCCESS) {
+      raise_system_error(rb_eRuntimeError, err);
+    }
+  }
+
+  // channel : To wide char
+  len =
+    MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(channel), RSTRING_LEN(channel), NULL, 0);
+  evtChannel = ALLOCV_N(WCHAR, wchannelBuf, len + 1);
+  MultiByteToWideChar(
+    CP_UTF8, 0, RSTRING_PTR(channel), RSTRING_LEN(channel), evtChannel, len);
+  evtChannel[len] = L'\0';
+
+  // xpath : To wide char
+  len = MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(xpath), RSTRING_LEN(xpath), NULL, 0);
+  evtXPath = ALLOCV_N(WCHAR, wpathBuf, len + 1);
+  MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(xpath), RSTRING_LEN(xpath), evtXPath, len);
+  evtXPath[len] = L'\0';
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  winevtQuery->query = EvtQuery(
+    hRemoteHandle, evtChannel, evtXPath, EvtQueryChannelPath | EvtQueryTolerateQueryErrors);
+  err = GetLastError();
+  if (err != ERROR_SUCCESS) {
+    raise_system_error(rb_eRuntimeError, err);
+  }
+  winevtQuery->offset = 0L;
+  winevtQuery->timeout = 0L;
+  winevtQuery->renderAsXML = TRUE;
+  winevtQuery->preserveQualifiers = FALSE;
+  winevtQuery->localeInfo = &default_locale;
+  winevtQuery->remoteHandle = hRemoteHandle;
+
+  ALLOCV_END(wchannelBuf);
+  ALLOCV_END(wpathBuf);
+
+  return Qnil;
+}
+
+/*
+ * This method returns querying event offset.
+ *
+ * @return [Integer]
+ */
+static VALUE
+rb_winevt_query_get_offset(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  return LONG2NUM(winevtQuery->offset);
+}
+
+/*
+ * This method specifies querying event offset.
+ *
+ * @param offset [Integer] offset value
+ */
+static VALUE
+rb_winevt_query_set_offset(VALUE self, VALUE offset)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  winevtQuery->offset = NUM2LONG(offset);
+
+  return Qnil;
+}
+
+/*
+ * This method returns timeout value.
+ *
+ * @return [Integer]
+ */
+static VALUE
+rb_winevt_query_get_timeout(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  return LONG2NUM(winevtQuery->timeout);
+}
+
+/*
+ * This method specifies timeout value.
+ *
+ * @param timeout [Integer] timeout value
+ */
+static VALUE
+rb_winevt_query_set_timeout(VALUE self, VALUE timeout)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  winevtQuery->timeout = NUM2LONG(timeout);
+
+  return Qnil;
+}
+
+/*
+ * Handle the next values. Since v0.6.0, this method is used for
+ * testing only. Please use #each instead.
+ *
+ * @return [Boolean]
+ *
+ * @see each
+ */
+static VALUE
+rb_winevt_query_next(VALUE self)
+{
+  EVT_HANDLE hEvents[QUERY_ARRAY_SIZE];
+  ULONG count;
+  DWORD status = ERROR_SUCCESS;
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  if (!EvtNext(winevtQuery->query, QUERY_ARRAY_SIZE, hEvents, INFINITE, 0, &count)) {
+    status = GetLastError();
+    if (ERROR_CANCELLED == status) {
+      return Qfalse;
+    }
+    if (ERROR_NO_MORE_ITEMS != status) {
+      return Qfalse;
+    }
+  }
+
+  if (status == ERROR_SUCCESS) {
+    winevtQuery->count = count;
+    for (int i = 0; i < count; i++) {
+      winevtQuery->hEvents[i] = hEvents[i];
+    }
+
+    return Qtrue;
+  }
+
+  return Qfalse;
+}
+
+static VALUE
+rb_winevt_query_render(VALUE self, EVT_HANDLE event)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  if (winevtQuery->renderAsXML) {
+    return render_to_rb_str(event, EvtRenderEventXml);
+  } else {
+    return render_system_event(event, winevtQuery->preserveQualifiers);
+  }
+}
+
+static VALUE
+rb_winevt_query_message(EVT_HANDLE event, LocaleInfo* localeInfo, EVT_HANDLE hRemote)
+{
+  WCHAR* wResult;
+  VALUE utf8str;
+
+  wResult = get_description(event, localeInfo->langID, hRemote);
+  utf8str = wstr_to_rb_str(CP_UTF8, wResult, -1);
+  free(wResult);
+
+  return utf8str;
+}
+
+static VALUE
+rb_winevt_query_string_inserts(EVT_HANDLE event)
+{
+  return get_values(event);
+}
+
+static DWORD
+get_evt_seek_flag_from_cstr(char* flag_str)
+{
+  if (strcmp(flag_str, "first") == 0)
+    return EvtSeekRelativeToFirst;
+  else if (strcmp(flag_str, "last") == 0)
+    return EvtSeekRelativeToLast;
+  else if (strcmp(flag_str, "current") == 0)
+    return EvtSeekRelativeToCurrent;
+  else if (strcmp(flag_str, "bookmark") == 0)
+    return EvtSeekRelativeToBookmark;
+  else if (strcmp(flag_str, "originmask") == 0)
+    return EvtSeekOriginMask;
+  else if (strcmp(flag_str, "strict") == 0)
+    return EvtSeekStrict;
+  else
+    rb_raise(rb_eArgError, "Unknown seek flag: %s", flag_str);
+
+  return 0;
+}
+
+/*
+ * This method specifies seek strategy.
+ *
+ * @param bookmark_or_flag [Bookmark|Query::Flag]
+ * @return [Boolean]
+ */
+static VALUE
+rb_winevt_query_seek(VALUE self, VALUE bookmark_or_flag)
+{
+  struct WinevtQuery* winevtQuery;
+  struct WinevtBookmark* winevtBookmark = NULL;
+  DWORD flag = 0;
+
+  switch (TYPE(bookmark_or_flag)) {
+    case T_SYMBOL:
+      flag = get_evt_seek_flag_from_cstr(RSTRING_PTR(rb_sym2str(bookmark_or_flag)));
+      break;
+    case T_STRING:
+      flag = get_evt_seek_flag_from_cstr(StringValueCStr(bookmark_or_flag));
+      break;
+    case T_FIXNUM:
+      flag = NUM2LONG(bookmark_or_flag);
+      break;
+    default:
+      if (!rb_obj_is_kind_of(bookmark_or_flag, rb_cBookmark))
+        rb_raise(rb_eArgError, "Expected a String or a Symbol or a Bookmark instance");
+
+      winevtBookmark = EventBookMark(bookmark_or_flag);
+  }
+
+  if (winevtBookmark) {
+    TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+    if (EvtSeek(winevtQuery->query,
+                winevtQuery->offset,
+                winevtBookmark->bookmark,
+                winevtQuery->timeout,
+                EvtSeekRelativeToBookmark))
+      return Qtrue;
+  } else {
+    TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+    if (EvtSeek(
+          winevtQuery->query, winevtQuery->offset, NULL, winevtQuery->timeout, flag)) {
+      return Qtrue;
+    }
+  }
+
+  return Qfalse;
+}
+
+static VALUE
+rb_winevt_query_close_handle(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  for (int i = 0; i < winevtQuery->count; i++) {
+    if (winevtQuery->hEvents[i] != NULL) {
+      EvtClose(winevtQuery->hEvents[i]);
+      winevtQuery->hEvents[i] = NULL;
+    }
+  }
+
+  return Qnil;
+}
+
+static VALUE
+rb_winevt_query_each_yield(VALUE self)
+{
+  RETURN_ENUMERATOR(self, 0, 0);
+
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  for (int i = 0; i < winevtQuery->count; i++) {
+    rb_yield_values(3,
+                    rb_winevt_query_render(self, winevtQuery->hEvents[i]),
+                    rb_winevt_query_message(winevtQuery->hEvents[i], winevtQuery->localeInfo,
+                                            winevtQuery->remoteHandle),
+                    rb_winevt_query_string_inserts(winevtQuery->hEvents[i]));
+  }
+  return Qnil;
+}
+
+/*
+ * Enumerate to obtain Windows EventLog contents.
+ *
+ * This method yields the following:
+ * (Stringified EventLog, Stringified detail message, Stringified
+ * insert values)
+ *
+ * @yield (String,String,String)
+ *
+ */
+static VALUE
+rb_winevt_query_each(VALUE self)
+{
+  RETURN_ENUMERATOR(self, 0, 0);
+
+  while (rb_winevt_query_next(self)) {
+    rb_ensure(rb_winevt_query_each_yield, self, rb_winevt_query_close_handle, self);
+  }
+
+  return Qnil;
+}
+
+/*
+ * This method returns whether render as xml or not.
+ *
+ * @return [Boolean]
+ */
+static VALUE
+rb_winevt_query_render_as_xml_p(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  return winevtQuery->renderAsXML ? Qtrue : Qfalse;
+}
+
+/*
+ * This method specifies whether render as xml or not.
+ *
+ * @param rb_render_as_xml [Boolean]
+ */
+static VALUE
+rb_winevt_query_set_render_as_xml(VALUE self, VALUE rb_render_as_xml)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  winevtQuery->renderAsXML = RTEST(rb_render_as_xml);
+
+  return Qnil;
+}
+
+/*
+ * This method specifies whether preserving qualifiers key or not.
+ *
+ * @since 0.7.3
+ * @param rb_preserve_qualifiers [Boolean]
+ */
+static VALUE
+rb_winevt_query_set_preserve_qualifiers(VALUE self, VALUE rb_preserve_qualifiers)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(
+    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  winevtQuery->preserveQualifiers = RTEST(rb_preserve_qualifiers);
+
+  return Qnil;
+}
+
+/*
+ * This method returns whether preserving qualifiers or not.
+ *
+ * @since 0.7.3
+ * @return [Integer]
+ */
+static VALUE
+rb_winevt_query_get_preserve_qualifiers_p(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(
+    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  return winevtQuery->preserveQualifiers ? Qtrue : Qfalse;
+}
+
+/*
+ * This method specifies locale with [String].
+ *
+ * @since 0.8.0
+ * @param rb_locale_str [String]
+ */
+static VALUE
+rb_winevt_query_set_locale(VALUE self, VALUE rb_locale_str)
+{
+  struct WinevtQuery* winevtQuery;
+  LocaleInfo* locale_info = &default_locale;
+
+  TypedData_Get_Struct(
+    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  locale_info = get_locale_info_from_rb_str(rb_locale_str);
+
+  winevtQuery->localeInfo = locale_info;
+
+  return Qnil;
+}
+
+/*
+ * This method obtains specified locale with [String].
+ *
+ * @since 0.8.0
+ */
+static VALUE
+rb_winevt_query_get_locale(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(
+    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  if (winevtQuery->localeInfo->langCode) {
+    return rb_str_new2(winevtQuery->localeInfo->langCode);
+  } else {
+    return rb_str_new2(default_locale.langCode);
+  }
+}
+
+/*
+ * This method cancels channel query.
+ *
+ * @return [Boolean]
+ * @since 0.9.1
+ */
+static VALUE
+rb_winevt_query_cancel(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+  BOOL result = FALSE;
+
+  TypedData_Get_Struct(
+    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  if (winevtQuery->query) {
+    result = EvtCancel(winevtQuery->query);
+  }
+
+  if (result) {
+    return Qtrue;
+  } else {
+    return Qfalse;
+  }
+}
+
+/*
+ * This method closes channel handles forcibly.
+ *
+ * @since 0.9.1
+ */
+static VALUE
+rb_winevt_query_close(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(
+    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  close_handles(winevtQuery);
+
+  return Qnil;
+}
+
+void
+Init_winevt_query(VALUE rb_cEventLog)
+{
+  rb_cQuery = rb_define_class_under(rb_cEventLog, "Query", rb_cObject);
+  rb_define_alloc_func(rb_cQuery, rb_winevt_query_alloc);
+
+  rb_cFlag = rb_define_module_under(rb_cQuery, "Flag");
+
+  /* clang-format off */
+  /*
+   * EVT_SEEK_FLAGS enumeration: EvtSeekRelativeToFirst
+   * @since 0.6.0
+   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekRelativeToFirst
+   */
+  rb_define_const(rb_cFlag, "RelativeToFirst", LONG2NUM(EvtSeekRelativeToFirst));
+  /*
+   * EVT_SEEK_FLAGS enumeration: EvtSeekRelativeToLast
+   * @since 0.6.0
+   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekRelativeToLast
+   */
+  rb_define_const(rb_cFlag, "RelativeToLast", LONG2NUM(EvtSeekRelativeToLast));
+  /*
+   * EVT_SEEK_FLAGS enumeration: EvtSeekRelativeToCurrent
+   * @since 0.6.0
+   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekRelativeToCurrent
+   */
+  rb_define_const(rb_cFlag, "RelativeToCurrent", LONG2NUM(EvtSeekRelativeToCurrent));
+  /*
+   * EVT_SEEK_FLAGS enumeration: EvtSeekRelativeToBookmark
+   * @since 0.6.0
+   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekRelativeToBookmark
+   */
+  rb_define_const(rb_cFlag, "RelativeToBookmark", LONG2NUM(EvtSeekRelativeToBookmark));
+  /*
+   * EVT_SEEK_FLAGS enumeration: EvtSeekOriginMask
+   * @since 0.6.0
+   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekOriginMask
+   */
+  rb_define_const(rb_cFlag, "OriginMask", LONG2NUM(EvtSeekOriginMask));
+  /*
+   * EVT_SEEK_FLAGS enumeration: EvtSeekStrict
+   * @since 0.6.0
+   * @see https://msdn.microsoft.com/en-us/windows/desktop/aa385575#EvtSeekStrict
+   */
+  rb_define_const(rb_cFlag, "Strict", LONG2NUM(EvtSeekStrict));
+  /* clang-format on */
+
+  rb_define_method(rb_cQuery, "initialize", rb_winevt_query_initialize, -1);
+  rb_define_method(rb_cQuery, "next", rb_winevt_query_next, 0);
+  rb_define_method(rb_cQuery, "seek", rb_winevt_query_seek, 1);
+  rb_define_method(rb_cQuery, "offset", rb_winevt_query_get_offset, 0);
+  rb_define_method(rb_cQuery, "offset=", rb_winevt_query_set_offset, 1);
+  rb_define_method(rb_cQuery, "timeout", rb_winevt_query_get_timeout, 0);
+  rb_define_method(rb_cQuery, "timeout=", rb_winevt_query_set_timeout, 1);
+  rb_define_method(rb_cQuery, "each", rb_winevt_query_each, 0);
+  rb_define_method(rb_cQuery, "render_as_xml?", rb_winevt_query_render_as_xml_p, 0);
+  rb_define_method(rb_cQuery, "render_as_xml=", rb_winevt_query_set_render_as_xml, 1);
+  /*
+   * @since 0.7.3
+   */
+  rb_define_method(rb_cQuery, "preserve_qualifiers?", rb_winevt_query_get_preserve_qualifiers_p, 0);
+  /*
+   * @since 0.7.3
+   */
+  rb_define_method(rb_cQuery, "preserve_qualifiers=", rb_winevt_query_set_preserve_qualifiers, 1);
+  /*
+   * @since 0.8.0
+   */
+  rb_define_method(rb_cQuery, "locale", rb_winevt_query_get_locale, 0);
+  /*
+   * @since 0.8.0
+   */
+  rb_define_method(rb_cQuery, "locale=", rb_winevt_query_set_locale, 1);
+  /*
+   * @since 0.9.1
+   */
+  rb_define_method(rb_cQuery, "cancel", rb_winevt_query_cancel, 0);
+  /*
+   * @since 0.9.1
+   */
+  rb_define_method(rb_cQuery, "close", rb_winevt_query_close, 0);
+}