Class: Fluent::WinEvtLog::WindowsLogWatcher

Inherits:
Object
  • Object
show all
Defined in:
lib/fluent/plugin/in_winevtlog.rb

Defined Under Namespace

Classes: TimerWatcher

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(cat, pe, &receive_lines) ⇒ WindowsLogWatcher

Returns a new instance of WindowsLogWatcher.



127
128
129
130
131
132
 
# File 'lib/fluent/plugin/in_winevtlog.rb', line 127

def initialize(cat, pe, &receive_lines)
  @cat = cat
  @pe = pe || MemoryPositionEntry.new
  @receive_lines = receive_lines
  @timer_trigger = TimerWatcher.new(1, true, &method(:on_notify))
end

Instance Attribute Details

#cat ⇒ Object (readonly)

Returns the value of attribute cat.



134
135
136
 
# File 'lib/fluent/plugin/in_winevtlog.rb', line 134

def cat
  @cat
end

#pe ⇒ Object

Returns the value of attribute pe.



136
137
138
 
# File 'lib/fluent/plugin/in_winevtlog.rb', line 136

def pe
  @pe
end

#unwatched ⇒ Object

Returns the value of attribute unwatched.



135
136
137
 
# File 'lib/fluent/plugin/in_winevtlog.rb', line 135

def unwatched
  @unwatched
end

Instance Method Details

#attach(loop) ⇒ Object 



138
139
140
141
 
# File 'lib/fluent/plugin/in_winevtlog.rb', line 138

def attach(loop)
  @timer_trigger.attach(loop)
  on_notify
end

#close ⇒ Object 



147
148
149
 
# File 'lib/fluent/plugin/in_winevtlog.rb', line 147

def close
  detach
end

#detach ⇒ Object 



143
144
145
 
# File 'lib/fluent/plugin/in_winevtlog.rb', line 143

def detach
  @timer_trigger.detach if @timer_trigger.attached?
end

#on_notify ⇒ Object 



151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
 
# File 'lib/fluent/plugin/in_winevtlog.rb', line 151

def on_notify
  el = EventLog.open(@cat)
  rl_sn = [el.oldest_record_number, el.total_records]
  pe_sn = [@pe.read_start, @pe.read_num]
  # if total_records is zero, oldest_record_number has no meaning.
  if rl_sn[1] == 0
    return
  end
  
  if pe_sn[0] == 0 && pe_sn[1] == 0
    @pe.update(rl_sn[0], rl_sn[1])
    return
  end

  cur_end = rl_sn[0] + rl_sn[1] -1
  old_end = pe_sn[0] + pe_sn[1] -1

  if (rl_sn[0] < pe_sn[0])
    # may be a record number rotated.
    cur_end += 0xFFFFFFFF
  end

  if (cur_end <= old_end)
    # something occured.
    @pe.update(rl_sn[0], rl_sn[1])
    return
  end

  read_more = false
  begin
    numlines = cur_end - old_end
    winlogs = el.read(Windows::Constants::EVENTLOG_SEEK_READ | Windows::Constants::EVENTLOG_FORWARDS_READ, old_end + 1)
    @receive_lines.call(winlogs, pe_sn)
    @pe.update(pe_sn[0], pe_sn[1])
    old_end = pe_sn[0] + pe_sn[1] -1
  end while read_more
  el.close
  
end