Class: Winevt::EventLog::Subscribe

Inherits:
Object
  • Object
show all
Defined in:
ext/winevt/winevt_subscribe.c,
lib/winevt/subscribe.rb,
ext/winevt/winevt.c,
ext/winevt/winevt_subscribe.c

Overview

Subscribe Windows EventLog channel.

Examples:

require 'winevt'

@subscribe = Winevt::EventLog::Subscribe.new
@subscribe.tail = true
@subscribe.rate_limit = 80
@subscribe.subscribe(
  "Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"
)
while true do
  @subscribe.each do |eventlog, message, string_inserts|
    puts ({eventlog: eventlog, data: message})
  end
  sleep(0.1)
end

See Also:

Defined Under Namespace

Classes: RemoteHandlerError, SubscribeHandlerError

Constant Summary collapse

RATE_INFINITE =

For Subscribe#rate_limit=. It represents unspecified rate limit.

Since:

  • 0.6.0

SUBSCRIBE_RATE_INFINITE

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Subscribe

Initalize Subscribe class.



98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
 
# File 'ext/winevt/winevt_subscribe.c', line 98

static VALUE
rb_winevt_subscribe_initialize(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->rateLimit = SUBSCRIBE_RATE_INFINITE;
  winevtSubscribe->lastTime = 0;
  winevtSubscribe->currentRate = 0;
  winevtSubscribe->renderAsXML = TRUE;
  winevtSubscribe->readExistingEvents = TRUE;
  winevtSubscribe->preserveQualifiers = FALSE;
  winevtSubscribe->localeInfo = &default_locale;
  winevtSubscribe->preserveSID = TRUE;

  return Qnil;
}

Instance Method Details

#bookmark ⇒ String

This method renders bookmark content which is related to Subscribe class instance.

Returns:

  • (String) 


511
512
513
514
515
516
517
518
519
520
 
# File 'ext/winevt/winevt_subscribe.c', line 511

static VALUE
rb_winevt_subscribe_get_bookmark(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return render_to_rb_str(winevtSubscribe->bookmark, EvtRenderBookmark);
}

#cancel ⇒ Boolean

This method cancels channel subscription.

Returns:

  • (Boolean)

Since:

  • 0.9.1



719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
 
# File 'ext/winevt/winevt_subscribe.c', line 719

static VALUE
rb_winevt_subscribe_cancel(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;
  BOOL result = FALSE;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  if (winevtSubscribe->subscription) {
    result = EvtCancel(winevtSubscribe->subscription);
  }

  if (result) {
    return Qtrue;
  } else {
    return Qfalse;
  }
}

#close ⇒ Object

This method closes channel handles forcibly.

Since:

  • 0.9.1



744
745
746
747
748
749
750
751
752
753
754
755
 
# File 'ext/winevt/winevt_subscribe.c', line 744

static VALUE
rb_winevt_subscribe_close(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  close_handles(winevtSubscribe);

  return Qnil;
}

#each {|String, String, String| ... } ⇒ Object

Enumerate to obtain Windows EventLog contents.

This method yields the following: (Stringified EventLog, Stringified detail message, Stringified insert values)

Yields:

  • (String, String, String) 


493
494
495
496
497
498
499
500
501
502
503
504
 
# File 'ext/winevt/winevt_subscribe.c', line 493

static VALUE
rb_winevt_subscribe_each(VALUE self)
{
  RETURN_ENUMERATOR(self, 0, 0);

  while (rb_winevt_subscribe_next(self)) {
    rb_ensure(
      rb_winevt_subscribe_each_yield, self, rb_winevt_subscribe_close_handle, self);
  }

  return Qnil;
}

#locale ⇒ Object

This method obtains specified locale with [String].

Since:

  • 0.8.0



664
665
666
667
668
669
670
671
672
673
674
675
676
677
 
# File 'ext/winevt/winevt_subscribe.c', line 664

static VALUE
rb_winevt_subscribe_get_locale(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  if (winevtSubscribe->localeInfo->langCode) {
    return rb_str_new2(winevtSubscribe->localeInfo->langCode);
  } else {
    return rb_str_new2(default_locale.langCode);
  }
}

#locale=(rb_locale_str) ⇒ Object

This method specifies locale with [String].

Parameters:

  • rb_locale_str (String)

Since:

  • 0.8.0



643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
 
# File 'ext/winevt/winevt_subscribe.c', line 643

static VALUE
rb_winevt_subscribe_set_locale(VALUE self, VALUE rb_locale_str)
{
  struct WinevtSubscribe* winevtSubscribe;
  LocaleInfo* locale_info = &default_locale;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  locale_info = get_locale_info_from_rb_str(rb_locale_str);

  winevtSubscribe->localeInfo = locale_info;

  return Qnil;
}

#next ⇒ Boolean

Handle the next values. Since v0.6.0, this method is used for testing only. Please use #each instead.

Returns:

  • (Boolean)

See Also:



339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
 
# File 'ext/winevt/winevt_subscribe.c', line 339

static VALUE
rb_winevt_subscribe_next(VALUE self)
{
  EVT_HANDLE hEvents[SUBSCRIBE_ARRAY_SIZE];
  ULONG count = 0;
  DWORD status = ERROR_SUCCESS;
  DWORD dwWait = 0;

  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  if (is_rate_limit_exceeded(winevtSubscribe)) {
    return Qfalse;
  }

  /* If subscription handle is NULL, it should return false. */
  if (!winevtSubscribe->subscription) {
    return Qfalse;
  }

  /* If a signalEvent notifies whether a state of processed event(s)
   * is existing or not.
   * For checking for a result of WaitForSingleObject,
   * we need to raise SubscribeHandlerError exception when
   * WAIT_FAILED is detected for further investigations.
   * Note that we don't need to wait explicitly here.
   * Because this function is inside of each enumerator.
   * So, WaitForSingleObject should return immediately and should be
   * processed with the latter each loops if there is no more items.
   * Just intended to check that there is no errors here. */
  dwWait = WaitForSingleObject(winevtSubscribe->signalEvent, 0);
  if (dwWait == WAIT_FAILED) {
    raise_system_error(rb_eSubscribeHandlerError, GetLastError());
  } else if (dwWait != WAIT_OBJECT_0) {
    return Qfalse;
  }

  if (!EvtNext(winevtSubscribe->subscription,
               SUBSCRIBE_ARRAY_SIZE,
               hEvents,
               INFINITE,
               0,
               &count)) {
    status = GetLastError();
    if (ERROR_CANCELLED == status) {
      return Qfalse;
    }
    if (ERROR_NO_MORE_ITEMS != status) {
      return Qfalse;
    }

    ResetEvent(winevtSubscribe->signalEvent);
  }

  if (status == ERROR_SUCCESS) {
    winevtSubscribe->count = count;
    for (int i = 0; i < count; i++) {
      winevtSubscribe->hEvents[i] = hEvents[i];
      EvtUpdateBookmark(winevtSubscribe->bookmark, winevtSubscribe->hEvents[i]);
    }

    update_to_reflect_rate_limit_state(winevtSubscribe, count);

    return Qtrue;
  }

  return Qfalse;
}

#preserve_qualifiers=(rb_preserve_qualifiers) ⇒ Object

This method specifies whether preserving qualifiers key or not.

Parameters:

  • rb_preserve_qualifiers (Boolean)

Since:

  • 0.7.3



607
608
609
610
611
612
613
614
615
616
617
618
 
# File 'ext/winevt/winevt_subscribe.c', line 607

static VALUE
rb_winevt_subscribe_set_preserve_qualifiers(VALUE self, VALUE rb_preserve_qualifiers)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->preserveQualifiers = RTEST(rb_preserve_qualifiers);

  return Qnil;
}

#preserve_qualifiers? ⇒ Integer

This method returns whether preserving qualifiers or not.

Returns:

  • (Integer)

Since:

  • 0.7.3



626
627
628
629
630
631
632
633
634
635
 
# File 'ext/winevt/winevt_subscribe.c', line 626

static VALUE
rb_winevt_subscribe_get_preserve_qualifiers_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->preserveQualifiers ? Qtrue : Qfalse;
}

#preserve_sid=(rb_preserve_sid_p) ⇒ Object

This method specifies whether preserving SID or not.

Parameters:

  • rb_preserve_sid_p (Boolean) 


684
685
686
687
688
689
690
691
692
693
694
695
 
# File 'ext/winevt/winevt_subscribe.c', line 684

static VALUE
rb_winevt_subscribe_set_preserve_sid(VALUE self, VALUE rb_preserve_sid_p)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->preserveSID = RTEST(rb_preserve_sid_p);

  return Qnil;
}

#preserve_sid? ⇒ Boolean

This method returns whether preserving SID or not.

Returns:

  • (Boolean) 


702
703
704
705
706
707
708
709
710
711
 
# File 'ext/winevt/winevt_subscribe.c', line 702

static VALUE
rb_winevt_subscribe_preserve_sid_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->preserveSID ? Qtrue : Qfalse;
}

#rate_limit ⇒ Integer

This method returns rate limit value.

Returns:

  • (Integer)

Since:

  • 0.6.0



528
529
530
531
532
533
534
535
536
537
 
# File 'ext/winevt/winevt_subscribe.c', line 528

static VALUE
rb_winevt_subscribe_get_rate_limit(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return INT2NUM(winevtSubscribe->rateLimit);
}

#rate_limit=(rb_rate_limit) ⇒ Object

This method specifies rate limit value.

Parameters:

  • rb_rate_limit (Integer) —

    rate_limit value

Since:

  • 0.6.0



545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
 
# File 'ext/winevt/winevt_subscribe.c', line 545

static VALUE
rb_winevt_subscribe_set_rate_limit(VALUE self, VALUE rb_rate_limit)
{
  struct WinevtSubscribe* winevtSubscribe;
  DWORD rateLimit;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  rateLimit = NUM2LONG(rb_rate_limit);

  if ((rateLimit != SUBSCRIBE_RATE_INFINITE) && (rateLimit < 10 || rateLimit % 10)) {
    rb_raise(rb_eArgError, "Specify a multiples of 10 or RATE_INFINITE constant");
  } else {
    winevtSubscribe->rateLimit = rateLimit;
  }

  return Qnil;
}

#read_existing_events=(rb_read_existing_events_p) ⇒ Object

This method specifies whether read existing events or not.

Parameters:

  • rb_read_existing_events_p (Boolean) 


123
124
125
126
127
128
129
130
131
132
133
134
 
# File 'ext/winevt/winevt_subscribe.c', line 123

static VALUE
rb_winevt_subscribe_set_read_existing_events(VALUE self, VALUE rb_read_existing_events_p)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->readExistingEvents = RTEST(rb_read_existing_events_p);

  return Qnil;
}

#read_existing_events? ⇒ Boolean

This method returns whether read existing events or not.

Returns:

  • (Boolean) 


141
142
143
144
145
146
147
148
149
150
 
# File 'ext/winevt/winevt_subscribe.c', line 141

static VALUE
rb_winevt_subscribe_read_existing_events_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->readExistingEvents ? Qtrue : Qfalse;
}

#render_as_xml=(rb_render_as_xml) ⇒ Object

This method specifies whether render as xml or not.

Parameters:

  • rb_render_as_xml (Boolean)

Since:

  • 0.6.0



588
589
590
591
592
593
594
595
596
597
598
599
 
# File 'ext/winevt/winevt_subscribe.c', line 588

static VALUE
rb_winevt_subscribe_set_render_as_xml(VALUE self, VALUE rb_render_as_xml)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->renderAsXML = RTEST(rb_render_as_xml);

  return Qnil;
}

#render_as_xml? ⇒ Boolean

This method returns whether render as xml or not.

Returns:

  • (Boolean)

Since:

  • 0.6.0



571
572
573
574
575
576
577
578
579
580
 
# File 'ext/winevt/winevt_subscribe.c', line 571

static VALUE
rb_winevt_subscribe_render_as_xml_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->renderAsXML ? Qtrue : Qfalse;
}

#subscribe(path, query, bookmark = nil, session = nil) ⇒ Boolean

Subscribe into a Windows EventLog channel.

Parameters:

  • path (String) —

    Subscribe Channel

  • query (String) —

    Query string for channel

  • bookmark (Bookmark) (defaults to: nil) —

    bookmark Bookmark class instance.

  • session (Session) (defaults to: nil) —

    Session information for remoting access.

Returns:

  • (Boolean) 


163
164
165
166
167
168
169
170
171
172
 
# File 'ext/winevt/winevt_subscribe.c', line 163

def subscribe(path, query, bookmark = nil, session = nil)
  if bookmark.is_a?(Winevt::EventLog::Bookmark) &&
     session.is_a?(Winevt::EventLog::Session)
    subscribe_raw(path, query, bookmark.render, session)
  elsif bookmark.is_a?(Winevt::EventLog::Bookmark)
    subscribe_raw(path, query, bookmark.render)
  else
    subscribe_raw(path, query)
  end
end

#subscribe_raw ⇒ Object 



4
 
# File 'lib/winevt/subscribe.rb', line 4

alias_method :subscribe_raw, :subscribe