Class: Winevt::EventLog::Query

Inherits:
Object
  • Object
show all
Defined in:
lib/winevt/query.rb,
ext/winevt/winevt.c,
ext/winevt/winevt_query.c

Defined Under Namespace

Classes: Error

Instance Method Summary collapse

Constructor Details

#initialize(channel, xpath) ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
 
# File 'ext/winevt/winevt_query.c', line 37

static VALUE
rb_winevt_query_initialize(VALUE self, VALUE channel, VALUE xpath)
{
  PWSTR evtChannel, evtXPath;
  struct WinevtQuery *winevtQuery;
  DWORD len;
  VALUE wchannelBuf, wpathBuf;

  Check_Type(channel, T_STRING);
  Check_Type(xpath, T_STRING);

  // channel : To wide char
  len = MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(channel), RSTRING_LEN(channel), NULL, 0);
  evtChannel = ALLOCV_N(WCHAR, wchannelBuf, len+1);
  MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(channel), RSTRING_LEN(channel), evtChannel, len);
  evtChannel[len] = L'\0';

  // xpath : To wide char
  len = MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(xpath), RSTRING_LEN(xpath), NULL, 0);
  evtXPath = ALLOCV_N(WCHAR, wpathBuf, len+1);
  MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(xpath), RSTRING_LEN(xpath), evtXPath, len);
  evtXPath[len] = L'\0';

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  winevtQuery->query = EvtQuery(NULL, evtChannel, evtXPath,
                                EvtQueryChannelPath | EvtQueryTolerateQueryErrors);
  winevtQuery->offset = 0L;
  winevtQuery->timeout = 0L;

  ALLOCV_END(wchannelBuf);
  ALLOCV_END(wpathBuf);

  return Qnil;
}

Instance Method Details

#each ⇒ Object 



223
224
225
226
227
228
229
 
# File 'ext/winevt/winevt_query.c', line 223

def each
  each_raw do |xml, message, string_inserts|
    placeholdered_message = message.gsub(/(%\d+)/, '\1$s')
    replaced_message = sprintf(placeholdered_message, *string_inserts) rescue message.gsub(/(%\d+)/, "?")
    yield(xml, replaced_message, string_inserts)
  end
end

#each_raw ⇒ Object 



4
 
# File 'lib/winevt/query.rb', line 4

alias_method :each_raw, :each

#message ⇒ Object 



150
151
152
153
154
155
156
157
158
159
160
 
# File 'ext/winevt/winevt_query.c', line 150

static VALUE
rb_winevt_query_message(VALUE self)
{
  char* result;
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
  result = get_description(winevtQuery->event);

  return rb_utf8_str_new_cstr(result);
}

#next ⇒ Object 



117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
 
# File 'ext/winevt/winevt_query.c', line 117

static VALUE
rb_winevt_query_next(VALUE self)
{
  EVT_HANDLE event;
  ULONG      count;
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  if (EvtNext(winevtQuery->query, 1, &event, INFINITE, 0, &count) != FALSE) {
    winevtQuery->event = event;
    winevtQuery->count = count;

    return Qtrue;
  }

  return Qfalse;
}

#offset(offset) ⇒ Object 



73
74
75
76
77
78
79
80
81
 
# File 'ext/winevt/winevt_query.c', line 73

static VALUE
rb_winevt_query_get_offset(VALUE self, VALUE offset)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  return LONG2NUM(winevtQuery->offset);
}

#offset=(offset) ⇒ Object 



83
84
85
86
87
88
89
90
91
92
93
 
# File 'ext/winevt/winevt_query.c', line 83

static VALUE
rb_winevt_query_set_offset(VALUE self, VALUE offset)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  winevtQuery->offset = NUM2LONG(offset);

  return Qnil;
}

#render ⇒ Object 



137
138
139
140
141
142
143
144
145
146
147
148
 
# File 'ext/winevt/winevt_query.c', line 137

static VALUE
rb_winevt_query_render(VALUE self)
{
  char* result;
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
  result = render_event(winevtQuery->event, EvtRenderEventXml);
  get_description(winevtQuery->event);

  return rb_utf8_str_new_cstr(result);
}

#seek(bookmark_or_flag) ⇒ Object 



188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
 
# File 'ext/winevt/winevt_query.c', line 188

static VALUE
rb_winevt_query_seek(VALUE self, VALUE bookmark_or_flag)
{
  struct WinevtQuery *winevtQuery;
  struct WinevtBookmark *winevtBookmark = NULL;
  DWORD status;
  DWORD flag;

  switch (TYPE(bookmark_or_flag)) {
  case T_SYMBOL:
    flag = get_evt_seek_flag_from_cstr(RSTRING_PTR(rb_sym2str(bookmark_or_flag)));
    break;
  case T_STRING:
    flag = get_evt_seek_flag_from_cstr(StringValueCStr(bookmark_or_flag));
    break;
  default:
    if (!rb_obj_is_kind_of(bookmark_or_flag, rb_cBookmark))
      rb_raise(rb_eArgError, "Expected a String or a Symbol or a Bookmark instance");

    winevtBookmark = EventBookMark(bookmark_or_flag);
  }

  if (winevtBookmark) {
    TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
    if (EvtSeek(winevtQuery->query, winevtQuery->offset, winevtBookmark->bookmark, winevtQuery->timeout, EvtSeekRelativeToBookmark))
      return Qtrue;
  } else {
    TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
    if (EvtSeek(winevtQuery->query, winevtQuery->offset, NULL, winevtQuery->timeout, flag))
      return Qtrue;
  }

  return Qfalse;
}

#string_inserts ⇒ Object 



162
163
164
165
166
167
168
169
 
# File 'ext/winevt/winevt_query.c', line 162

static VALUE
rb_winevt_query_string_inserts(VALUE self)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
  return get_values(winevtQuery->event);
}

#timeout(timeout) ⇒ Object 



95
96
97
98
99
100
101
102
103
 
# File 'ext/winevt/winevt_query.c', line 95

static VALUE
rb_winevt_query_get_timeout(VALUE self, VALUE timeout)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  return LONG2NUM(winevtQuery->timeout);
}

#timeout=(timeout) ⇒ Object 



105
106
107
108
109
110
111
112
113
114
115
 
# File 'ext/winevt/winevt_query.c', line 105

static VALUE
rb_winevt_query_set_timeout(VALUE self, VALUE timeout)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  winevtQuery->timeout = NUM2LONG(timeout);

  return Qnil;
}