winevt_c 0.9.1 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.clang-format +4 -4
- data/.github/workflows/linux.yml +26 -0
- data/Gemfile +6 -6
- data/LICENSE.txt +202 -202
- data/README.md +97 -97
- data/Rakefile +37 -37
- data/appveyor.yml +48 -26
- data/example/bookmark.rb +9 -9
- data/example/enumerate_channels.rb +13 -13
- data/example/eventlog.rb +13 -13
- data/example/locale.rb +13 -13
- data/example/rate_limit.rb +14 -14
- data/example/tailing.rb +21 -21
- data/ext/winevt/extconf.rb +24 -24
- data/ext/winevt/winevt.c +30 -30
- data/ext/winevt/winevt_bookmark.c +149 -149
- data/ext/winevt/winevt_c.h +133 -132
- data/ext/winevt/winevt_channel.c +327 -327
- data/ext/winevt/winevt_locale.c +92 -92
- data/ext/winevt/winevt_locale_info.c +68 -68
- data/ext/winevt/winevt_query.c +649 -650
- data/ext/winevt/winevt_session.c +425 -425
- data/ext/winevt/winevt_subscribe.c +756 -757
- data/ext/winevt/winevt_utils.cpp +790 -718
- data/lib/winevt/bookmark.rb +6 -6
- data/lib/winevt/query.rb +6 -6
- data/lib/winevt/session.rb +15 -15
- data/lib/winevt/subscribe.rb +18 -18
- data/lib/winevt/version.rb +3 -3
- data/lib/winevt.rb +14 -14
- data/winevt_c.gemspec +34 -34
- metadata +8 -9
- data/.travis.yml +0 -15
@@ -1,149 +1,149 @@
|
|
1
|
-
#include <winevt_c.h>
|
2
|
-
|
3
|
-
/* clang-format off */
|
4
|
-
/*
|
5
|
-
* Document-class: Winevt::EventLog::Bookmark
|
6
|
-
*
|
7
|
-
* Bookmark for querying/subscribing Windows EventLog progress.
|
8
|
-
*
|
9
|
-
* @example
|
10
|
-
* require 'winevt'
|
11
|
-
*
|
12
|
-
* @query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
|
13
|
-
* @bookmark = Winevt::EventLog::Bookmark.new
|
14
|
-
* @query.each do |xml|
|
15
|
-
* @bookmark.update(@query)
|
16
|
-
* end
|
17
|
-
*
|
18
|
-
* puts @bookmark.render
|
19
|
-
*/
|
20
|
-
/* clang-format pn */
|
21
|
-
|
22
|
-
VALUE rb_cBookmark;
|
23
|
-
|
24
|
-
static void bookmark_free(void* ptr);
|
25
|
-
|
26
|
-
static const rb_data_type_t rb_winevt_bookmark_type = { "winevt/bookmark",
|
27
|
-
{
|
28
|
-
0,
|
29
|
-
bookmark_free,
|
30
|
-
0,
|
31
|
-
},
|
32
|
-
NULL,
|
33
|
-
NULL,
|
34
|
-
RUBY_TYPED_FREE_IMMEDIATELY };
|
35
|
-
|
36
|
-
static void
|
37
|
-
bookmark_free(void* ptr)
|
38
|
-
{
|
39
|
-
struct WinevtBookmark* winevtBookmark = (struct WinevtBookmark*)ptr;
|
40
|
-
if (winevtBookmark->bookmark)
|
41
|
-
EvtClose(winevtBookmark->bookmark);
|
42
|
-
|
43
|
-
xfree(ptr);
|
44
|
-
}
|
45
|
-
|
46
|
-
static VALUE
|
47
|
-
rb_winevt_bookmark_alloc(VALUE klass)
|
48
|
-
{
|
49
|
-
VALUE obj;
|
50
|
-
struct WinevtBookmark* winevtBookmark;
|
51
|
-
obj = TypedData_Make_Struct(
|
52
|
-
klass, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
|
53
|
-
return obj;
|
54
|
-
}
|
55
|
-
|
56
|
-
/*
|
57
|
-
* Initalize Bookmark class. Receive XML string or nil.
|
58
|
-
*
|
59
|
-
* @overload initailize(options={})
|
60
|
-
* @option options [String] XML rendered Bookmark string.
|
61
|
-
* @return [Bookmark]
|
62
|
-
*
|
63
|
-
*/
|
64
|
-
static VALUE
|
65
|
-
rb_winevt_bookmark_initialize(int argc, VALUE* argv, VALUE self)
|
66
|
-
{
|
67
|
-
PWSTR bookmarkXml;
|
68
|
-
VALUE wbookmarkXmlBuf;
|
69
|
-
DWORD len;
|
70
|
-
struct WinevtBookmark* winevtBookmark;
|
71
|
-
|
72
|
-
TypedData_Get_Struct(
|
73
|
-
self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
|
74
|
-
|
75
|
-
if (argc == 0) {
|
76
|
-
winevtBookmark->bookmark = EvtCreateBookmark(NULL);
|
77
|
-
} else if (argc == 1) {
|
78
|
-
VALUE rb_bookmarkXml;
|
79
|
-
rb_scan_args(argc, argv, "10", &rb_bookmarkXml);
|
80
|
-
Check_Type(rb_bookmarkXml, T_STRING);
|
81
|
-
|
82
|
-
// bookmarkXml : To wide char
|
83
|
-
len = MultiByteToWideChar(
|
84
|
-
CP_UTF8, 0, RSTRING_PTR(rb_bookmarkXml), RSTRING_LEN(rb_bookmarkXml), NULL, 0);
|
85
|
-
bookmarkXml = ALLOCV_N(WCHAR, wbookmarkXmlBuf, len + 1);
|
86
|
-
MultiByteToWideChar(CP_UTF8,
|
87
|
-
0,
|
88
|
-
RSTRING_PTR(rb_bookmarkXml),
|
89
|
-
RSTRING_LEN(rb_bookmarkXml),
|
90
|
-
bookmarkXml,
|
91
|
-
len);
|
92
|
-
bookmarkXml[len] = L'\0';
|
93
|
-
winevtBookmark->bookmark = EvtCreateBookmark(bookmarkXml);
|
94
|
-
ALLOCV_END(wbookmarkXmlBuf);
|
95
|
-
}
|
96
|
-
|
97
|
-
return Qnil;
|
98
|
-
}
|
99
|
-
|
100
|
-
/*
|
101
|
-
* This method updates bookmark and returns Bookmark instance.
|
102
|
-
*
|
103
|
-
* @param event [Query]
|
104
|
-
* @return [Bookmark]
|
105
|
-
*/
|
106
|
-
static VALUE
|
107
|
-
rb_winevt_bookmark_update(VALUE self, VALUE event)
|
108
|
-
{
|
109
|
-
struct WinevtQuery* winevtQuery;
|
110
|
-
struct WinevtBookmark* winevtBookmark;
|
111
|
-
|
112
|
-
winevtQuery = EventQuery(event);
|
113
|
-
|
114
|
-
TypedData_Get_Struct(
|
115
|
-
self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
|
116
|
-
|
117
|
-
for (int i = 0; i < winevtQuery->count; i++) {
|
118
|
-
if (!EvtUpdateBookmark(winevtBookmark->bookmark, winevtQuery->hEvents[i]))
|
119
|
-
return Qfalse;
|
120
|
-
}
|
121
|
-
return Qtrue;
|
122
|
-
}
|
123
|
-
|
124
|
-
/*
|
125
|
-
* This method renders bookmark class content.
|
126
|
-
*
|
127
|
-
* @return [String]
|
128
|
-
*/
|
129
|
-
static VALUE
|
130
|
-
rb_winevt_bookmark_render(VALUE self)
|
131
|
-
{
|
132
|
-
struct WinevtBookmark* winevtBookmark;
|
133
|
-
|
134
|
-
TypedData_Get_Struct(
|
135
|
-
self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
|
136
|
-
|
137
|
-
return render_to_rb_str(winevtBookmark->bookmark, EvtRenderBookmark);
|
138
|
-
}
|
139
|
-
|
140
|
-
void
|
141
|
-
Init_winevt_bookmark(VALUE rb_cEventLog)
|
142
|
-
{
|
143
|
-
rb_cBookmark = rb_define_class_under(rb_cEventLog, "Bookmark", rb_cObject);
|
144
|
-
|
145
|
-
rb_define_alloc_func(rb_cBookmark, rb_winevt_bookmark_alloc);
|
146
|
-
rb_define_method(rb_cBookmark, "initialize", rb_winevt_bookmark_initialize, -1);
|
147
|
-
rb_define_method(rb_cBookmark, "update", rb_winevt_bookmark_update, 1);
|
148
|
-
rb_define_method(rb_cBookmark, "render", rb_winevt_bookmark_render, 0);
|
149
|
-
}
|
1
|
+
#include <winevt_c.h>
|
2
|
+
|
3
|
+
/* clang-format off */
|
4
|
+
/*
|
5
|
+
* Document-class: Winevt::EventLog::Bookmark
|
6
|
+
*
|
7
|
+
* Bookmark for querying/subscribing Windows EventLog progress.
|
8
|
+
*
|
9
|
+
* @example
|
10
|
+
* require 'winevt'
|
11
|
+
*
|
12
|
+
* @query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
|
13
|
+
* @bookmark = Winevt::EventLog::Bookmark.new
|
14
|
+
* @query.each do |xml|
|
15
|
+
* @bookmark.update(@query)
|
16
|
+
* end
|
17
|
+
*
|
18
|
+
* puts @bookmark.render
|
19
|
+
*/
|
20
|
+
/* clang-format pn */
|
21
|
+
|
22
|
+
VALUE rb_cBookmark;
|
23
|
+
|
24
|
+
static void bookmark_free(void* ptr);
|
25
|
+
|
26
|
+
static const rb_data_type_t rb_winevt_bookmark_type = { "winevt/bookmark",
|
27
|
+
{
|
28
|
+
0,
|
29
|
+
bookmark_free,
|
30
|
+
0,
|
31
|
+
},
|
32
|
+
NULL,
|
33
|
+
NULL,
|
34
|
+
RUBY_TYPED_FREE_IMMEDIATELY };
|
35
|
+
|
36
|
+
static void
|
37
|
+
bookmark_free(void* ptr)
|
38
|
+
{
|
39
|
+
struct WinevtBookmark* winevtBookmark = (struct WinevtBookmark*)ptr;
|
40
|
+
if (winevtBookmark->bookmark)
|
41
|
+
EvtClose(winevtBookmark->bookmark);
|
42
|
+
|
43
|
+
xfree(ptr);
|
44
|
+
}
|
45
|
+
|
46
|
+
static VALUE
|
47
|
+
rb_winevt_bookmark_alloc(VALUE klass)
|
48
|
+
{
|
49
|
+
VALUE obj;
|
50
|
+
struct WinevtBookmark* winevtBookmark;
|
51
|
+
obj = TypedData_Make_Struct(
|
52
|
+
klass, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
|
53
|
+
return obj;
|
54
|
+
}
|
55
|
+
|
56
|
+
/*
|
57
|
+
* Initalize Bookmark class. Receive XML string or nil.
|
58
|
+
*
|
59
|
+
* @overload initailize(options={})
|
60
|
+
* @option options [String] XML rendered Bookmark string.
|
61
|
+
* @return [Bookmark]
|
62
|
+
*
|
63
|
+
*/
|
64
|
+
static VALUE
|
65
|
+
rb_winevt_bookmark_initialize(int argc, VALUE* argv, VALUE self)
|
66
|
+
{
|
67
|
+
PWSTR bookmarkXml;
|
68
|
+
VALUE wbookmarkXmlBuf;
|
69
|
+
DWORD len;
|
70
|
+
struct WinevtBookmark* winevtBookmark;
|
71
|
+
|
72
|
+
TypedData_Get_Struct(
|
73
|
+
self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
|
74
|
+
|
75
|
+
if (argc == 0) {
|
76
|
+
winevtBookmark->bookmark = EvtCreateBookmark(NULL);
|
77
|
+
} else if (argc == 1) {
|
78
|
+
VALUE rb_bookmarkXml;
|
79
|
+
rb_scan_args(argc, argv, "10", &rb_bookmarkXml);
|
80
|
+
Check_Type(rb_bookmarkXml, T_STRING);
|
81
|
+
|
82
|
+
// bookmarkXml : To wide char
|
83
|
+
len = MultiByteToWideChar(
|
84
|
+
CP_UTF8, 0, RSTRING_PTR(rb_bookmarkXml), RSTRING_LEN(rb_bookmarkXml), NULL, 0);
|
85
|
+
bookmarkXml = ALLOCV_N(WCHAR, wbookmarkXmlBuf, len + 1);
|
86
|
+
MultiByteToWideChar(CP_UTF8,
|
87
|
+
0,
|
88
|
+
RSTRING_PTR(rb_bookmarkXml),
|
89
|
+
RSTRING_LEN(rb_bookmarkXml),
|
90
|
+
bookmarkXml,
|
91
|
+
len);
|
92
|
+
bookmarkXml[len] = L'\0';
|
93
|
+
winevtBookmark->bookmark = EvtCreateBookmark(bookmarkXml);
|
94
|
+
ALLOCV_END(wbookmarkXmlBuf);
|
95
|
+
}
|
96
|
+
|
97
|
+
return Qnil;
|
98
|
+
}
|
99
|
+
|
100
|
+
/*
|
101
|
+
* This method updates bookmark and returns Bookmark instance.
|
102
|
+
*
|
103
|
+
* @param event [Query]
|
104
|
+
* @return [Bookmark]
|
105
|
+
*/
|
106
|
+
static VALUE
|
107
|
+
rb_winevt_bookmark_update(VALUE self, VALUE event)
|
108
|
+
{
|
109
|
+
struct WinevtQuery* winevtQuery;
|
110
|
+
struct WinevtBookmark* winevtBookmark;
|
111
|
+
|
112
|
+
winevtQuery = EventQuery(event);
|
113
|
+
|
114
|
+
TypedData_Get_Struct(
|
115
|
+
self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
|
116
|
+
|
117
|
+
for (int i = 0; i < winevtQuery->count; i++) {
|
118
|
+
if (!EvtUpdateBookmark(winevtBookmark->bookmark, winevtQuery->hEvents[i]))
|
119
|
+
return Qfalse;
|
120
|
+
}
|
121
|
+
return Qtrue;
|
122
|
+
}
|
123
|
+
|
124
|
+
/*
|
125
|
+
* This method renders bookmark class content.
|
126
|
+
*
|
127
|
+
* @return [String]
|
128
|
+
*/
|
129
|
+
static VALUE
|
130
|
+
rb_winevt_bookmark_render(VALUE self)
|
131
|
+
{
|
132
|
+
struct WinevtBookmark* winevtBookmark;
|
133
|
+
|
134
|
+
TypedData_Get_Struct(
|
135
|
+
self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
|
136
|
+
|
137
|
+
return render_to_rb_str(winevtBookmark->bookmark, EvtRenderBookmark);
|
138
|
+
}
|
139
|
+
|
140
|
+
void
|
141
|
+
Init_winevt_bookmark(VALUE rb_cEventLog)
|
142
|
+
{
|
143
|
+
rb_cBookmark = rb_define_class_under(rb_cEventLog, "Bookmark", rb_cObject);
|
144
|
+
|
145
|
+
rb_define_alloc_func(rb_cBookmark, rb_winevt_bookmark_alloc);
|
146
|
+
rb_define_method(rb_cBookmark, "initialize", rb_winevt_bookmark_initialize, -1);
|
147
|
+
rb_define_method(rb_cBookmark, "update", rb_winevt_bookmark_update, 1);
|
148
|
+
rb_define_method(rb_cBookmark, "render", rb_winevt_bookmark_render, 0);
|
149
|
+
}
|
data/ext/winevt/winevt_c.h
CHANGED
@@ -1,132 +1,133 @@
|
|
1
|
-
#ifndef _WINEVT_C_H_
|
2
|
-
#define _WINEVT_C_H_
|
3
|
-
|
4
|
-
#include <ruby.h>
|
5
|
-
#include <ruby/encoding.h>
|
6
|
-
|
7
|
-
#ifdef __GNUC__
|
8
|
-
#include <w32api.h>
|
9
|
-
#define MINIMUM_WINDOWS_VERSION WindowsVista
|
10
|
-
#else /* __GNUC__ */
|
11
|
-
#define MINIMUM_WINDOWS_VERSION 0x0600 /* Vista */
|
12
|
-
#endif /* __GNUC__ */
|
13
|
-
|
14
|
-
#ifdef _WIN32_WINNT
|
15
|
-
#undef _WIN32_WINNT
|
16
|
-
#endif /* WIN32_WINNT */
|
17
|
-
#define _WIN32_WINNT MINIMUM_WINDOWS_VERSION
|
18
|
-
|
19
|
-
#include <time.h>
|
20
|
-
#include <winevt.h>
|
21
|
-
#define EventQuery(object) ((struct WinevtQuery*)DATA_PTR(object))
|
22
|
-
#define EventBookMark(object) ((struct WinevtBookmark*)DATA_PTR(object))
|
23
|
-
#define EventChannel(object) ((struct WinevtChannel*)DATA_PTR(object))
|
24
|
-
#define EventSession(object) ((struct WinevtSession*)DATA_PTR(object))
|
25
|
-
|
26
|
-
typedef struct {
|
27
|
-
LANGID langID;
|
28
|
-
CHAR* langCode;
|
29
|
-
CHAR* description;
|
30
|
-
} LocaleInfo;
|
31
|
-
|
32
|
-
#ifdef __cplusplus
|
33
|
-
extern "C" {
|
34
|
-
#endif /* __cplusplus */
|
35
|
-
|
36
|
-
VALUE wstr_to_rb_str(UINT cp, const WCHAR* wstr, int clen);
|
37
|
-
#if defined(__cplusplus)
|
38
|
-
[[ noreturn ]]
|
39
|
-
#endif /* __cplusplus */
|
40
|
-
void raise_system_error(VALUE error, DWORD errorCode);
|
41
|
-
VALUE render_to_rb_str(EVT_HANDLE handle, DWORD flags);
|
42
|
-
EVT_HANDLE connect_to_remote(LPWSTR computerName, LPWSTR domain,
|
43
|
-
LPWSTR username, LPWSTR password,
|
44
|
-
EVT_RPC_LOGIN_FLAGS flags
|
45
|
-
|
46
|
-
|
47
|
-
VALUE
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
extern VALUE
|
56
|
-
extern VALUE
|
57
|
-
extern VALUE
|
58
|
-
extern VALUE
|
59
|
-
extern VALUE
|
60
|
-
extern VALUE
|
61
|
-
extern VALUE
|
62
|
-
extern VALUE
|
63
|
-
|
64
|
-
|
65
|
-
|
66
|
-
LPWSTR
|
67
|
-
LPWSTR
|
68
|
-
LPWSTR
|
69
|
-
|
70
|
-
|
71
|
-
|
72
|
-
|
73
|
-
extern LocaleInfo
|
74
|
-
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
85
|
-
|
86
|
-
|
87
|
-
|
88
|
-
|
89
|
-
|
90
|
-
|
91
|
-
|
92
|
-
|
93
|
-
|
94
|
-
EVT_HANDLE
|
95
|
-
|
96
|
-
|
97
|
-
LONG
|
98
|
-
|
99
|
-
BOOL
|
100
|
-
|
101
|
-
|
102
|
-
|
103
|
-
|
104
|
-
|
105
|
-
#define
|
106
|
-
|
107
|
-
|
108
|
-
|
109
|
-
|
110
|
-
|
111
|
-
EVT_HANDLE
|
112
|
-
EVT_HANDLE
|
113
|
-
|
114
|
-
DWORD
|
115
|
-
|
116
|
-
|
117
|
-
|
118
|
-
|
119
|
-
|
120
|
-
BOOL
|
121
|
-
|
122
|
-
|
123
|
-
|
124
|
-
|
125
|
-
|
126
|
-
void
|
127
|
-
void
|
128
|
-
void
|
129
|
-
void
|
130
|
-
void
|
131
|
-
|
132
|
-
|
1
|
+
#ifndef _WINEVT_C_H_
|
2
|
+
#define _WINEVT_C_H_
|
3
|
+
|
4
|
+
#include <ruby.h>
|
5
|
+
#include <ruby/encoding.h>
|
6
|
+
|
7
|
+
#ifdef __GNUC__
|
8
|
+
#include <w32api.h>
|
9
|
+
#define MINIMUM_WINDOWS_VERSION WindowsVista
|
10
|
+
#else /* __GNUC__ */
|
11
|
+
#define MINIMUM_WINDOWS_VERSION 0x0600 /* Vista */
|
12
|
+
#endif /* __GNUC__ */
|
13
|
+
|
14
|
+
#ifdef _WIN32_WINNT
|
15
|
+
#undef _WIN32_WINNT
|
16
|
+
#endif /* WIN32_WINNT */
|
17
|
+
#define _WIN32_WINNT MINIMUM_WINDOWS_VERSION
|
18
|
+
|
19
|
+
#include <time.h>
|
20
|
+
#include <winevt.h>
|
21
|
+
#define EventQuery(object) ((struct WinevtQuery*)DATA_PTR(object))
|
22
|
+
#define EventBookMark(object) ((struct WinevtBookmark*)DATA_PTR(object))
|
23
|
+
#define EventChannel(object) ((struct WinevtChannel*)DATA_PTR(object))
|
24
|
+
#define EventSession(object) ((struct WinevtSession*)DATA_PTR(object))
|
25
|
+
|
26
|
+
typedef struct {
|
27
|
+
LANGID langID;
|
28
|
+
CHAR* langCode;
|
29
|
+
CHAR* description;
|
30
|
+
} LocaleInfo;
|
31
|
+
|
32
|
+
#ifdef __cplusplus
|
33
|
+
extern "C" {
|
34
|
+
#endif /* __cplusplus */
|
35
|
+
|
36
|
+
VALUE wstr_to_rb_str(UINT cp, const WCHAR* wstr, int clen);
|
37
|
+
#if defined(__cplusplus)
|
38
|
+
[[ noreturn ]]
|
39
|
+
#endif /* __cplusplus */
|
40
|
+
void raise_system_error(VALUE error, DWORD errorCode);
|
41
|
+
VALUE render_to_rb_str(EVT_HANDLE handle, DWORD flags);
|
42
|
+
EVT_HANDLE connect_to_remote(LPWSTR computerName, LPWSTR domain,
|
43
|
+
LPWSTR username, LPWSTR password,
|
44
|
+
EVT_RPC_LOGIN_FLAGS flags,
|
45
|
+
DWORD *error_code);
|
46
|
+
WCHAR* get_description(EVT_HANDLE handle, LANGID langID, EVT_HANDLE hRemote);
|
47
|
+
VALUE get_values(EVT_HANDLE handle);
|
48
|
+
VALUE render_system_event(EVT_HANDLE handle, BOOL preserve_qualifiers);
|
49
|
+
LocaleInfo* get_locale_info_from_rb_str(VALUE rb_locale_str);
|
50
|
+
|
51
|
+
#ifdef __cplusplus
|
52
|
+
}
|
53
|
+
#endif /* __cplusplus */
|
54
|
+
|
55
|
+
extern VALUE rb_cQuery;
|
56
|
+
extern VALUE rb_cFlag;
|
57
|
+
extern VALUE rb_cChannel;
|
58
|
+
extern VALUE rb_cBookmark;
|
59
|
+
extern VALUE rb_cSubscribe;
|
60
|
+
extern VALUE rb_eWinevtQueryError;
|
61
|
+
extern VALUE rb_eRemoteHandlerError;
|
62
|
+
extern VALUE rb_cLocale;
|
63
|
+
extern VALUE rb_cSession;
|
64
|
+
|
65
|
+
struct WinevtSession {
|
66
|
+
LPWSTR server;
|
67
|
+
LPWSTR domain;
|
68
|
+
LPWSTR username;
|
69
|
+
LPWSTR password;
|
70
|
+
EVT_RPC_LOGIN_FLAGS flags;
|
71
|
+
};
|
72
|
+
|
73
|
+
extern LocaleInfo localeInfoTable[];
|
74
|
+
extern LocaleInfo default_locale;
|
75
|
+
|
76
|
+
struct WinevtLocale {};
|
77
|
+
|
78
|
+
struct WinevtChannel
|
79
|
+
{
|
80
|
+
EVT_HANDLE channels;
|
81
|
+
BOOL force_enumerate;
|
82
|
+
};
|
83
|
+
|
84
|
+
struct WinevtBookmark
|
85
|
+
{
|
86
|
+
EVT_HANDLE bookmark;
|
87
|
+
ULONG count;
|
88
|
+
};
|
89
|
+
|
90
|
+
#define QUERY_ARRAY_SIZE 10
|
91
|
+
|
92
|
+
struct WinevtQuery
|
93
|
+
{
|
94
|
+
EVT_HANDLE query;
|
95
|
+
EVT_HANDLE hEvents[QUERY_ARRAY_SIZE];
|
96
|
+
ULONG count;
|
97
|
+
LONG offset;
|
98
|
+
LONG timeout;
|
99
|
+
BOOL renderAsXML;
|
100
|
+
BOOL preserveQualifiers;
|
101
|
+
LocaleInfo *localeInfo;
|
102
|
+
EVT_HANDLE remoteHandle;
|
103
|
+
};
|
104
|
+
|
105
|
+
#define SUBSCRIBE_ARRAY_SIZE 10
|
106
|
+
#define SUBSCRIBE_RATE_INFINITE -1
|
107
|
+
|
108
|
+
struct WinevtSubscribe
|
109
|
+
{
|
110
|
+
HANDLE signalEvent;
|
111
|
+
EVT_HANDLE subscription;
|
112
|
+
EVT_HANDLE bookmark;
|
113
|
+
EVT_HANDLE hEvents[SUBSCRIBE_ARRAY_SIZE];
|
114
|
+
DWORD count;
|
115
|
+
DWORD flags;
|
116
|
+
BOOL readExistingEvents;
|
117
|
+
DWORD rateLimit;
|
118
|
+
time_t lastTime;
|
119
|
+
DWORD currentRate;
|
120
|
+
BOOL renderAsXML;
|
121
|
+
BOOL preserveQualifiers;
|
122
|
+
LocaleInfo* localeInfo;
|
123
|
+
EVT_HANDLE remoteHandle;
|
124
|
+
};
|
125
|
+
|
126
|
+
void Init_winevt_query(VALUE rb_cEventLog);
|
127
|
+
void Init_winevt_channel(VALUE rb_cEventLog);
|
128
|
+
void Init_winevt_bookmark(VALUE rb_cEventLog);
|
129
|
+
void Init_winevt_subscribe(VALUE rb_cEventLog);
|
130
|
+
void Init_winevt_locale(VALUE rb_cEventLog);
|
131
|
+
void Init_winevt_session(VALUE rb_cEventLog);
|
132
|
+
|
133
|
+
#endif // _WINEVT_C_H
|