winevt_c 0.9.1 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.clang-format +4 -4
- data/.github/workflows/linux.yml +26 -0
- data/Gemfile +6 -6
- data/LICENSE.txt +202 -202
- data/README.md +97 -97
- data/Rakefile +37 -37
- data/appveyor.yml +48 -26
- data/example/bookmark.rb +9 -9
- data/example/enumerate_channels.rb +13 -13
- data/example/eventlog.rb +13 -13
- data/example/locale.rb +13 -13
- data/example/rate_limit.rb +14 -14
- data/example/tailing.rb +21 -21
- data/ext/winevt/extconf.rb +24 -24
- data/ext/winevt/winevt.c +30 -30
- data/ext/winevt/winevt_bookmark.c +149 -149
- data/ext/winevt/winevt_c.h +133 -132
- data/ext/winevt/winevt_channel.c +327 -327
- data/ext/winevt/winevt_locale.c +92 -92
- data/ext/winevt/winevt_locale_info.c +68 -68
- data/ext/winevt/winevt_query.c +649 -650
- data/ext/winevt/winevt_session.c +425 -425
- data/ext/winevt/winevt_subscribe.c +756 -757
- data/ext/winevt/winevt_utils.cpp +790 -718
- data/lib/winevt/bookmark.rb +6 -6
- data/lib/winevt/query.rb +6 -6
- data/lib/winevt/session.rb +15 -15
- data/lib/winevt/subscribe.rb +18 -18
- data/lib/winevt/version.rb +3 -3
- data/lib/winevt.rb +14 -14
- data/winevt_c.gemspec +34 -34
- metadata +8 -9
- data/.travis.yml +0 -15
data/README.md
CHANGED
@@ -1,97 +1,97 @@
|
|
1
|
-
# winevt_c
|
2
|
-
|
3
|
-
[](https://ci.appveyor.com/project/cosmo0920/winevt-c-6145k/branch/master)
|
4
|
-
|
5
|
-
## Prerequisites
|
6
|
-
|
7
|
-
* Windows Vista/Windows Server 2008 or later.
|
8
|
-
* gcc and g++ from MSYS2 for building C/C++ extension.
|
9
|
-
* Ruby 2.4 or later with MSYS2.
|
10
|
-
|
11
|
-
## Installation
|
12
|
-
|
13
|
-
Add this line to your application's Gemfile:
|
14
|
-
|
15
|
-
```ruby
|
16
|
-
gem 'winevt_c'
|
17
|
-
```
|
18
|
-
|
19
|
-
And then execute:
|
20
|
-
|
21
|
-
$ ridk exec bundle
|
22
|
-
|
23
|
-
Or install it yourself as:
|
24
|
-
|
25
|
-
$ ridk exec gem install winevt_c
|
26
|
-
|
27
|
-
## Fat gems building
|
28
|
-
|
29
|
-
* Docker is needed to build fat gem due to rake-compiler-dock uses docker container.
|
30
|
-
|
31
|
-
## Usage
|
32
|
-
|
33
|
-
Usage examples are found in [example directory](example).
|
34
|
-
|
35
|
-
### Multilingual description
|
36
|
-
|
37
|
-
Currently, the following locales should be supported to output description:
|
38
|
-
|
39
|
-
locale | language
|
40
|
-
---------:|:--------
|
41
|
-
bg\_BG | Bulgarian
|
42
|
-
zh\_CN | Simplified Chinese
|
43
|
-
zh\_TW | Traditional Chinese
|
44
|
-
zh\_HK | Chinese (Hong Kong)
|
45
|
-
zh\_SG | Chinese (Singapore)
|
46
|
-
hr\_HR | Croatian
|
47
|
-
cz\_CZ | Czech
|
48
|
-
da\_DK | Danish
|
49
|
-
nl\_NL | Dutch
|
50
|
-
nl\_BG | Dutch (Belgium)
|
51
|
-
en\_US | English (United States)
|
52
|
-
en\_GB | English (UK)
|
53
|
-
en\_AU | English (Australia)
|
54
|
-
en\_CA | English (Canada)
|
55
|
-
en\_NZ | English (New Zealand)
|
56
|
-
en\_IE | English (Ireland)
|
57
|
-
fi\_FI | Finnish
|
58
|
-
fr\_FR | French
|
59
|
-
fr\_BE | French (Belgium)
|
60
|
-
fr\_CA | French (Canada)
|
61
|
-
fr\_CH | French (Swiss)
|
62
|
-
de\_DE | German
|
63
|
-
de\_CH | German (Swiss)
|
64
|
-
de\_AT | German (Austria)
|
65
|
-
el\_GR | Greek (Ελληνικά)
|
66
|
-
hu\_HU | Hungarian
|
67
|
-
is\_IS | Icelandic
|
68
|
-
it\_IT | Italian (Italy)
|
69
|
-
it\_CH | Italian (Swiss)
|
70
|
-
ja\_JP | Japanese
|
71
|
-
ko\_KO | Korean
|
72
|
-
no\_NO | Norwegian (Bokmål)
|
73
|
-
nb\_NO | Norwegian (Bokmål)
|
74
|
-
nn\_NO | Norwegian (Nynorsk)
|
75
|
-
pl\_PL | Polish (Poland)
|
76
|
-
pt\_PT | Portuguese
|
77
|
-
pt\_BR | Portuguese (Brazil)
|
78
|
-
ro\_RO | Romanian
|
79
|
-
ru\_RU | Russian (русский язык)
|
80
|
-
sk\_SK | Slovak
|
81
|
-
sl\_SI | Slovenian
|
82
|
-
es\_ES | Spanish
|
83
|
-
es\_ES\_T | Spanish (Traditional)
|
84
|
-
es\_MX | Spanish (Mexico)
|
85
|
-
es\_ES\_M | Spanish (Modern)
|
86
|
-
sv\_SE | Swedish
|
87
|
-
tr\_TR | Turkish
|
88
|
-
|
89
|
-
## Development
|
90
|
-
|
91
|
-
After checking out the repo, run `bin/setup` to install dependencies. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
|
92
|
-
|
93
|
-
To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
|
94
|
-
|
95
|
-
## Contributing
|
96
|
-
|
97
|
-
Bug reports and pull requests are welcome on GitHub at https://github.com/fluent-plugins-nursery/winevt_c.
|
1
|
+
# winevt_c
|
2
|
+
|
3
|
+
[](https://ci.appveyor.com/project/cosmo0920/winevt-c-6145k/branch/master)
|
4
|
+
|
5
|
+
## Prerequisites
|
6
|
+
|
7
|
+
* Windows Vista/Windows Server 2008 or later.
|
8
|
+
* gcc and g++ from MSYS2 for building C/C++ extension.
|
9
|
+
* Ruby 2.4 or later with MSYS2.
|
10
|
+
|
11
|
+
## Installation
|
12
|
+
|
13
|
+
Add this line to your application's Gemfile:
|
14
|
+
|
15
|
+
```ruby
|
16
|
+
gem 'winevt_c'
|
17
|
+
```
|
18
|
+
|
19
|
+
And then execute:
|
20
|
+
|
21
|
+
$ ridk exec bundle
|
22
|
+
|
23
|
+
Or install it yourself as:
|
24
|
+
|
25
|
+
$ ridk exec gem install winevt_c
|
26
|
+
|
27
|
+
## Fat gems building
|
28
|
+
|
29
|
+
* Docker is needed to build fat gem due to rake-compiler-dock uses docker container.
|
30
|
+
|
31
|
+
## Usage
|
32
|
+
|
33
|
+
Usage examples are found in [example directory](example).
|
34
|
+
|
35
|
+
### Multilingual description
|
36
|
+
|
37
|
+
Currently, the following locales should be supported to output description:
|
38
|
+
|
39
|
+
locale | language
|
40
|
+
---------:|:--------
|
41
|
+
bg\_BG | Bulgarian
|
42
|
+
zh\_CN | Simplified Chinese
|
43
|
+
zh\_TW | Traditional Chinese
|
44
|
+
zh\_HK | Chinese (Hong Kong)
|
45
|
+
zh\_SG | Chinese (Singapore)
|
46
|
+
hr\_HR | Croatian
|
47
|
+
cz\_CZ | Czech
|
48
|
+
da\_DK | Danish
|
49
|
+
nl\_NL | Dutch
|
50
|
+
nl\_BG | Dutch (Belgium)
|
51
|
+
en\_US | English (United States)
|
52
|
+
en\_GB | English (UK)
|
53
|
+
en\_AU | English (Australia)
|
54
|
+
en\_CA | English (Canada)
|
55
|
+
en\_NZ | English (New Zealand)
|
56
|
+
en\_IE | English (Ireland)
|
57
|
+
fi\_FI | Finnish
|
58
|
+
fr\_FR | French
|
59
|
+
fr\_BE | French (Belgium)
|
60
|
+
fr\_CA | French (Canada)
|
61
|
+
fr\_CH | French (Swiss)
|
62
|
+
de\_DE | German
|
63
|
+
de\_CH | German (Swiss)
|
64
|
+
de\_AT | German (Austria)
|
65
|
+
el\_GR | Greek (Ελληνικά)
|
66
|
+
hu\_HU | Hungarian
|
67
|
+
is\_IS | Icelandic
|
68
|
+
it\_IT | Italian (Italy)
|
69
|
+
it\_CH | Italian (Swiss)
|
70
|
+
ja\_JP | Japanese
|
71
|
+
ko\_KO | Korean
|
72
|
+
no\_NO | Norwegian (Bokmål)
|
73
|
+
nb\_NO | Norwegian (Bokmål)
|
74
|
+
nn\_NO | Norwegian (Nynorsk)
|
75
|
+
pl\_PL | Polish (Poland)
|
76
|
+
pt\_PT | Portuguese
|
77
|
+
pt\_BR | Portuguese (Brazil)
|
78
|
+
ro\_RO | Romanian
|
79
|
+
ru\_RU | Russian (русский язык)
|
80
|
+
sk\_SK | Slovak
|
81
|
+
sl\_SI | Slovenian
|
82
|
+
es\_ES | Spanish
|
83
|
+
es\_ES\_T | Spanish (Traditional)
|
84
|
+
es\_MX | Spanish (Mexico)
|
85
|
+
es\_ES\_M | Spanish (Modern)
|
86
|
+
sv\_SE | Swedish
|
87
|
+
tr\_TR | Turkish
|
88
|
+
|
89
|
+
## Development
|
90
|
+
|
91
|
+
After checking out the repo, run `bin/setup` to install dependencies. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
|
92
|
+
|
93
|
+
To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
|
94
|
+
|
95
|
+
## Contributing
|
96
|
+
|
97
|
+
Bug reports and pull requests are welcome on GitHub at https://github.com/fluent-plugins-nursery/winevt_c.
|
data/Rakefile
CHANGED
@@ -1,37 +1,37 @@
|
|
1
|
-
require 'bundler'
|
2
|
-
Bundler::GemHelper.install_tasks
|
3
|
-
|
4
|
-
require "rake/testtask"
|
5
|
-
require 'rake_compiler_dock'
|
6
|
-
require 'rake/clean'
|
7
|
-
|
8
|
-
Rake::TestTask.new(:test) do |t|
|
9
|
-
t.libs << "test"
|
10
|
-
t.libs << "lib"
|
11
|
-
t.test_files = FileList["test/**/test_*.rb"]
|
12
|
-
end
|
13
|
-
|
14
|
-
require "rake/extensiontask"
|
15
|
-
|
16
|
-
spec = eval File.read("winevt_c.gemspec")
|
17
|
-
|
18
|
-
Rake::ExtensionTask.new("winevt", spec) do |ext|
|
19
|
-
ext.ext_dir = 'ext/winevt'
|
20
|
-
ext.cross_compile = true
|
21
|
-
ext.lib_dir = File.join(*['lib', 'winevt', ENV['FAT_DIR']].compact)
|
22
|
-
# cross_platform names are of MRI's platform name
|
23
|
-
ext.cross_platform = ['x86-mingw32', 'x64-mingw32']
|
24
|
-
end
|
25
|
-
|
26
|
-
desc 'Build gems for Windows per rake-compiler-dock'
|
27
|
-
task 'gem:native' do
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
rake
|
32
|
-
|
33
|
-
end
|
34
|
-
|
35
|
-
CLEAN.include('lib/winevt/winevt.*')
|
36
|
-
|
37
|
-
task :default => [:clobber, :compile, :test]
|
1
|
+
require 'bundler'
|
2
|
+
Bundler::GemHelper.install_tasks
|
3
|
+
|
4
|
+
require "rake/testtask"
|
5
|
+
require 'rake_compiler_dock'
|
6
|
+
require 'rake/clean'
|
7
|
+
|
8
|
+
Rake::TestTask.new(:test) do |t|
|
9
|
+
t.libs << "test"
|
10
|
+
t.libs << "lib"
|
11
|
+
t.test_files = FileList["test/**/test_*.rb"]
|
12
|
+
end
|
13
|
+
|
14
|
+
require "rake/extensiontask"
|
15
|
+
|
16
|
+
spec = eval File.read("winevt_c.gemspec")
|
17
|
+
|
18
|
+
Rake::ExtensionTask.new("winevt", spec) do |ext|
|
19
|
+
ext.ext_dir = 'ext/winevt'
|
20
|
+
ext.cross_compile = true
|
21
|
+
ext.lib_dir = File.join(*['lib', 'winevt', ENV['FAT_DIR']].compact)
|
22
|
+
# cross_platform names are of MRI's platform name
|
23
|
+
ext.cross_platform = ['x86-mingw32', 'x64-mingw32']
|
24
|
+
end
|
25
|
+
|
26
|
+
desc 'Build gems for Windows per rake-compiler-dock'
|
27
|
+
task 'gem:native' do
|
28
|
+
sh "bundle package"
|
29
|
+
# See RUBY_CC_VERSION in https://github.com/rake-compiler/rake-compiler-dock/blob/master/Dockerfile.mri
|
30
|
+
%w[ x86-mingw32 x64-mingw32 ].each do |plat|
|
31
|
+
RakeCompilerDock.sh "bundle --local && bundle exec rake native:#{plat} gem RUBY_CC_VERSION=2.4.0:2.5.0:2.6.0:2.7.0:3.0.0", platform: plat
|
32
|
+
end
|
33
|
+
end
|
34
|
+
|
35
|
+
CLEAN.include('lib/winevt/winevt.*')
|
36
|
+
|
37
|
+
task :default => [:clobber, :compile, :test]
|
data/appveyor.yml
CHANGED
@@ -1,26 +1,48 @@
|
|
1
|
-
version: '{build}'
|
2
|
-
|
3
|
-
|
4
|
-
|
5
|
-
|
6
|
-
|
7
|
-
|
8
|
-
|
9
|
-
-
|
10
|
-
-
|
11
|
-
-
|
12
|
-
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
- ruby_version: "
|
24
|
-
- ruby_version: "
|
25
|
-
- ruby_version: "
|
26
|
-
- ruby_version: "
|
1
|
+
version: '{build}'
|
2
|
+
|
3
|
+
image: Visual Studio 2019
|
4
|
+
|
5
|
+
# init:
|
6
|
+
# - ps: iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
|
7
|
+
|
8
|
+
install:
|
9
|
+
- SET PATH=C:\Ruby%ruby_version%\bin;%PATH%
|
10
|
+
- ruby --version
|
11
|
+
- gem --version
|
12
|
+
- bundle --version
|
13
|
+
- bundle install
|
14
|
+
- ridk.cmd exec bundle exec rake compile
|
15
|
+
build: off
|
16
|
+
test_script:
|
17
|
+
# - bundle exec rake test
|
18
|
+
- bundle exec rake test TESTOPTS=-v
|
19
|
+
|
20
|
+
# https://www.appveyor.com/docs/installed-software/#ruby
|
21
|
+
environment:
|
22
|
+
matrix:
|
23
|
+
- ruby_version: "31-x64"
|
24
|
+
- ruby_version: "31"
|
25
|
+
- ruby_version: "30-x64"
|
26
|
+
- ruby_version: "30"
|
27
|
+
- ruby_version: "27-x64"
|
28
|
+
- ruby_version: "27"
|
29
|
+
- ruby_version: "26-x64"
|
30
|
+
- ruby_version: "26"
|
31
|
+
- ruby_version: "25-x64"
|
32
|
+
- ruby_version: "25"
|
33
|
+
- ruby_version: "24-x64"
|
34
|
+
- ruby_version: "24"
|
35
|
+
|
36
|
+
for:
|
37
|
+
-
|
38
|
+
matrix:
|
39
|
+
only:
|
40
|
+
- ruby_version: "31-x64"
|
41
|
+
install:
|
42
|
+
- SET PATH=C:\Ruby%ruby_version%\bin;%PATH%
|
43
|
+
- ruby --version
|
44
|
+
- gem --version
|
45
|
+
- bundle --version
|
46
|
+
- ridk.cmd install 1 3
|
47
|
+
- ridk.cmd exec bundle install
|
48
|
+
- ridk.cmd exec bundle exec rake compile
|
data/example/bookmark.rb
CHANGED
@@ -1,9 +1,9 @@
|
|
1
|
-
require 'winevt'
|
2
|
-
|
3
|
-
@query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
|
4
|
-
@bookmark = Winevt::EventLog::Bookmark.new
|
5
|
-
@query.each do |xml|
|
6
|
-
@bookmark.update(@query)
|
7
|
-
end
|
8
|
-
|
9
|
-
puts @bookmark.render
|
1
|
+
require 'winevt'
|
2
|
+
|
3
|
+
@query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
|
4
|
+
@bookmark = Winevt::EventLog::Bookmark.new
|
5
|
+
@query.each do |xml|
|
6
|
+
@bookmark.update(@query)
|
7
|
+
end
|
8
|
+
|
9
|
+
puts @bookmark.render
|
@@ -1,13 +1,13 @@
|
|
1
|
-
require 'winevt'
|
2
|
-
|
3
|
-
@channels = Winevt::EventLog::Channel.new
|
4
|
-
@channels.force_enumerate = false
|
5
|
-
result = []
|
6
|
-
@channels.each do |channel|
|
7
|
-
result << channel
|
8
|
-
end
|
9
|
-
|
10
|
-
puts "length of channels: #{result.length}"
|
11
|
-
result.each do |r|
|
12
|
-
puts r
|
13
|
-
end
|
1
|
+
require 'winevt'
|
2
|
+
|
3
|
+
@channels = Winevt::EventLog::Channel.new
|
4
|
+
@channels.force_enumerate = false
|
5
|
+
result = []
|
6
|
+
@channels.each do |channel|
|
7
|
+
result << channel
|
8
|
+
end
|
9
|
+
|
10
|
+
puts "length of channels: #{result.length}"
|
11
|
+
result.each do |r|
|
12
|
+
puts r
|
13
|
+
end
|
data/example/eventlog.rb
CHANGED
@@ -1,13 +1,13 @@
|
|
1
|
-
require 'winevt'
|
2
|
-
|
3
|
-
@session = Winevt::EventLog::Session.new("127.0.0.1") # Or remote box ip
|
4
|
-
# @session.domain = "<EXAMPLEGROUP>"
|
5
|
-
# @session.username = "<username>"
|
6
|
-
# @session.password = "<password>"
|
7
|
-
@query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]", @session)
|
8
|
-
|
9
|
-
@query.render_as_xml = true
|
10
|
-
@query.preserve_qualifiers = true
|
11
|
-
@query.each do |eventlog, message, string_inserts|
|
12
|
-
puts ({eventlog: eventlog, data: message})
|
13
|
-
end
|
1
|
+
require 'winevt'
|
2
|
+
|
3
|
+
@session = Winevt::EventLog::Session.new("127.0.0.1") # Or remote box ip
|
4
|
+
# @session.domain = "<EXAMPLEGROUP>"
|
5
|
+
# @session.username = "<username>"
|
6
|
+
# @session.password = "<password>"
|
7
|
+
@query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]", @session)
|
8
|
+
|
9
|
+
@query.render_as_xml = true
|
10
|
+
@query.preserve_qualifiers = true
|
11
|
+
@query.each do |eventlog, message, string_inserts|
|
12
|
+
puts ({eventlog: eventlog, data: message})
|
13
|
+
end
|
data/example/locale.rb
CHANGED
@@ -1,13 +1,13 @@
|
|
1
|
-
require 'winevt'
|
2
|
-
|
3
|
-
@locale = Winevt::EventLog::Locale.new
|
4
|
-
|
5
|
-
header = <<EOC
|
6
|
-
locale | language
|
7
|
-
---------:|:--------
|
8
|
-
EOC
|
9
|
-
|
10
|
-
print header
|
11
|
-
@locale.each do |code, desc|
|
12
|
-
print "#{code.gsub("_", "\\_")}#{" "*(8 - code.size)}| #{desc}\n"
|
13
|
-
end
|
1
|
+
require 'winevt'
|
2
|
+
|
3
|
+
@locale = Winevt::EventLog::Locale.new
|
4
|
+
|
5
|
+
header = <<EOC
|
6
|
+
locale | language
|
7
|
+
---------:|:--------
|
8
|
+
EOC
|
9
|
+
|
10
|
+
print header
|
11
|
+
@locale.each do |code, desc|
|
12
|
+
print "#{code.gsub("_", "\\_")}#{" "*(8 - code.size)}| #{desc}\n"
|
13
|
+
end
|
data/example/rate_limit.rb
CHANGED
@@ -1,14 +1,14 @@
|
|
1
|
-
require 'winevt'
|
2
|
-
|
3
|
-
@subscribe = Winevt::EventLog::Subscribe.new
|
4
|
-
@subscribe.read_existing_events = true
|
5
|
-
@subscribe.rate_limit = 80
|
6
|
-
@subscribe.subscribe(
|
7
|
-
"Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"
|
8
|
-
)
|
9
|
-
while true do
|
10
|
-
@subscribe.each do |eventlog, message, string_inserts|
|
11
|
-
puts ({eventlog: eventlog, data: message})
|
12
|
-
end
|
13
|
-
sleep(0.1)
|
14
|
-
end
|
1
|
+
require 'winevt'
|
2
|
+
|
3
|
+
@subscribe = Winevt::EventLog::Subscribe.new
|
4
|
+
@subscribe.read_existing_events = true
|
5
|
+
@subscribe.rate_limit = 80
|
6
|
+
@subscribe.subscribe(
|
7
|
+
"Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"
|
8
|
+
)
|
9
|
+
while true do
|
10
|
+
@subscribe.each do |eventlog, message, string_inserts|
|
11
|
+
puts ({eventlog: eventlog, data: message})
|
12
|
+
end
|
13
|
+
sleep(0.1)
|
14
|
+
end
|
data/example/tailing.rb
CHANGED
@@ -1,21 +1,21 @@
|
|
1
|
-
require 'winevt'
|
2
|
-
|
3
|
-
@session = Winevt::EventLog::Session.new("127.0.0.1") # Or remote box ip
|
4
|
-
# @session.domain = "<EXAMPLEGROUP>"
|
5
|
-
# @session.username = "<username>"
|
6
|
-
# @session.password = "<password>"
|
7
|
-
@bookmark = Winevt::EventLog::Bookmark.new
|
8
|
-
@subscribe = Winevt::EventLog::Subscribe.new
|
9
|
-
@subscribe.read_existing_events = true
|
10
|
-
@subscribe.preserve_qualifiers = true
|
11
|
-
@subscribe.render_as_xml = true
|
12
|
-
@subscribe.subscribe(
|
13
|
-
"Security", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]",
|
14
|
-
@bookmark, @session
|
15
|
-
)
|
16
|
-
while true do
|
17
|
-
@subscribe.each do |eventlog, message, string_inserts|
|
18
|
-
puts ({eventlog: eventlog, data: message})
|
19
|
-
end
|
20
|
-
sleep(1)
|
21
|
-
end
|
1
|
+
require 'winevt'
|
2
|
+
|
3
|
+
@session = Winevt::EventLog::Session.new("127.0.0.1") # Or remote box ip
|
4
|
+
# @session.domain = "<EXAMPLEGROUP>"
|
5
|
+
# @session.username = "<username>"
|
6
|
+
# @session.password = "<password>"
|
7
|
+
@bookmark = Winevt::EventLog::Bookmark.new
|
8
|
+
@subscribe = Winevt::EventLog::Subscribe.new
|
9
|
+
@subscribe.read_existing_events = true
|
10
|
+
@subscribe.preserve_qualifiers = true
|
11
|
+
@subscribe.render_as_xml = true
|
12
|
+
@subscribe.subscribe(
|
13
|
+
"Security", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]",
|
14
|
+
@bookmark, @session
|
15
|
+
)
|
16
|
+
while true do
|
17
|
+
@subscribe.each do |eventlog, message, string_inserts|
|
18
|
+
puts ({eventlog: eventlog, data: message})
|
19
|
+
end
|
20
|
+
sleep(1)
|
21
|
+
end
|
data/ext/winevt/extconf.rb
CHANGED
@@ -1,24 +1,24 @@
|
|
1
|
-
require "mkmf"
|
2
|
-
require "rbconfig"
|
3
|
-
|
4
|
-
if RbConfig::CONFIG['host_os'] =~ /mingw/
|
5
|
-
$CFLAGS << ' -fno-omit-frame-pointer'
|
6
|
-
end
|
7
|
-
|
8
|
-
libdir = RbConfig::CONFIG["libdir"]
|
9
|
-
includedir = RbConfig::CONFIG["includedir"]
|
10
|
-
|
11
|
-
dir_config("winevt", includedir, libdir)
|
12
|
-
|
13
|
-
have_library("wevtapi")
|
14
|
-
have_func("EvtQuery", "winevt.h")
|
15
|
-
have_library("advapi32")
|
16
|
-
have_library("ole32")
|
17
|
-
|
18
|
-
$LDFLAGS << " -lwevtapi -ladvapi32 -lole32"
|
19
|
-
$CFLAGS << " -Wall -std=c99 -fPIC -fms-extensions "
|
20
|
-
$CXXFLAGS << " -Wall -std=c++11 -fPIC -fms-extensions "
|
21
|
-
# $CFLAGS << " -g -O0 -ggdb"
|
22
|
-
# $CXXFLAGS << " -g -O0 -ggdb"
|
23
|
-
|
24
|
-
create_makefile("winevt/winevt")
|
1
|
+
require "mkmf"
|
2
|
+
require "rbconfig"
|
3
|
+
|
4
|
+
if RbConfig::CONFIG['host_os'] =~ /mingw/
|
5
|
+
$CFLAGS << ' -fno-omit-frame-pointer'
|
6
|
+
end
|
7
|
+
|
8
|
+
libdir = RbConfig::CONFIG["libdir"]
|
9
|
+
includedir = RbConfig::CONFIG["includedir"]
|
10
|
+
|
11
|
+
dir_config("winevt", includedir, libdir)
|
12
|
+
|
13
|
+
have_library("wevtapi")
|
14
|
+
have_func("EvtQuery", "winevt.h")
|
15
|
+
have_library("advapi32")
|
16
|
+
have_library("ole32")
|
17
|
+
|
18
|
+
$LDFLAGS << " -lwevtapi -ladvapi32 -lole32"
|
19
|
+
$CFLAGS << " -Wall -std=c99 -fPIC -fms-extensions "
|
20
|
+
$CXXFLAGS << " -Wall -std=c++11 -fPIC -fms-extensions "
|
21
|
+
# $CFLAGS << " -g -O0 -ggdb"
|
22
|
+
# $CXXFLAGS << " -g -O0 -ggdb"
|
23
|
+
|
24
|
+
create_makefile("winevt/winevt")
|
data/ext/winevt/winevt.c
CHANGED
@@ -1,30 +1,30 @@
|
|
1
|
-
#include <winevt_c.h>
|
2
|
-
|
3
|
-
VALUE rb_mWinevt;
|
4
|
-
VALUE rb_cQuery;
|
5
|
-
VALUE rb_cEventLog;
|
6
|
-
VALUE rb_cSubscribe;
|
7
|
-
VALUE rb_eWinevtQueryError;
|
8
|
-
VALUE rb_eRemoteHandlerError;
|
9
|
-
|
10
|
-
static ID id_call;
|
11
|
-
|
12
|
-
void
|
13
|
-
Init_winevt(void)
|
14
|
-
{
|
15
|
-
rb_mWinevt = rb_define_module("Winevt");
|
16
|
-
rb_cEventLog = rb_define_class_under(rb_mWinevt, "EventLog", rb_cObject);
|
17
|
-
rb_cQuery = rb_define_class_under(rb_cEventLog, "Query", rb_cObject);
|
18
|
-
rb_cSubscribe = rb_define_class_under(rb_cEventLog, "Subscribe", rb_cObject);
|
19
|
-
rb_eWinevtQueryError = rb_define_class_under(rb_cQuery, "Error", rb_eStandardError);
|
20
|
-
rb_eRemoteHandlerError = rb_define_class_under(rb_cSubscribe, "RemoteHandlerError", rb_eRuntimeError);
|
21
|
-
|
22
|
-
Init_winevt_channel(rb_cEventLog);
|
23
|
-
Init_winevt_bookmark(rb_cEventLog);
|
24
|
-
Init_winevt_query(rb_cEventLog);
|
25
|
-
Init_winevt_subscribe(rb_cEventLog);
|
26
|
-
Init_winevt_locale(rb_cEventLog);
|
27
|
-
Init_winevt_session(rb_cEventLog);
|
28
|
-
|
29
|
-
id_call = rb_intern("call");
|
30
|
-
}
|
1
|
+
#include <winevt_c.h>
|
2
|
+
|
3
|
+
VALUE rb_mWinevt;
|
4
|
+
VALUE rb_cQuery;
|
5
|
+
VALUE rb_cEventLog;
|
6
|
+
VALUE rb_cSubscribe;
|
7
|
+
VALUE rb_eWinevtQueryError;
|
8
|
+
VALUE rb_eRemoteHandlerError;
|
9
|
+
|
10
|
+
static ID id_call;
|
11
|
+
|
12
|
+
void
|
13
|
+
Init_winevt(void)
|
14
|
+
{
|
15
|
+
rb_mWinevt = rb_define_module("Winevt");
|
16
|
+
rb_cEventLog = rb_define_class_under(rb_mWinevt, "EventLog", rb_cObject);
|
17
|
+
rb_cQuery = rb_define_class_under(rb_cEventLog, "Query", rb_cObject);
|
18
|
+
rb_cSubscribe = rb_define_class_under(rb_cEventLog, "Subscribe", rb_cObject);
|
19
|
+
rb_eWinevtQueryError = rb_define_class_under(rb_cQuery, "Error", rb_eStandardError);
|
20
|
+
rb_eRemoteHandlerError = rb_define_class_under(rb_cSubscribe, "RemoteHandlerError", rb_eRuntimeError);
|
21
|
+
|
22
|
+
Init_winevt_channel(rb_cEventLog);
|
23
|
+
Init_winevt_bookmark(rb_cEventLog);
|
24
|
+
Init_winevt_query(rb_cEventLog);
|
25
|
+
Init_winevt_subscribe(rb_cEventLog);
|
26
|
+
Init_winevt_locale(rb_cEventLog);
|
27
|
+
Init_winevt_session(rb_cEventLog);
|
28
|
+
|
29
|
+
id_call = rb_intern("call");
|
30
|
+
}
|