Class: Winevt::EventLog::Query

Inherits:

Object

• Object
• Winevt::EventLog::Query

Defined in:

lib/winevt/query.rb,
ext/winevt/winevt.c,
ext/winevt/winevt_query.c

Defined Under Namespace

Classes: Error

Instance Method Summary

• #each ⇒ Object
• #initialize(channel, xpath) ⇒ Object constructor
• #message ⇒ Object
• #next ⇒ Object
• #offset(offset) ⇒ Object
• #offset=(offset) ⇒ Object
• #render ⇒ Object
• #seek(bookmark_or_flag) ⇒ Object
• #string_inserts ⇒ Object
• #timeout(timeout) ⇒ Object
• #timeout=(timeout) ⇒ Object

Constructor Details

#initialize(channel, xpath) ⇒ Object

# File 'ext/winevt/winevt_query.c', line 37

static VALUE
rb_winevt_query_initialize(VALUE self, VALUE channel, VALUE xpath)
{
  PWSTR evtChannel, evtXPath;
  struct WinevtQuery *winevtQuery;
  DWORD len;
  VALUE wchannelBuf, wpathBuf;

  Check_Type(channel, T_STRING);
  Check_Type(xpath, T_STRING);

  // channel : To wide char
  len = MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(channel), RSTRING_LEN(channel), NULL, 0);
  evtChannel = ALLOCV_N(WCHAR, wchannelBuf, len+1);
  MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(channel), RSTRING_LEN(channel), evtChannel, len);
  evtChannel[len] = L'\0';

  // xpath : To wide char
  len = MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(xpath), RSTRING_LEN(xpath), NULL, 0);
  evtXPath = ALLOCV_N(WCHAR, wpathBuf, len+1);
  MultiByteToWideChar(CP_UTF8, 0, RSTRING_PTR(xpath), RSTRING_LEN(xpath), evtXPath, len);
  evtXPath[len] = L'\0';

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  winevtQuery->query = EvtQuery(NULL, evtChannel, evtXPath,
                                EvtQueryChannelPath | EvtQueryTolerateQueryErrors);
  winevtQuery->offset = 0L;
  winevtQuery->timeout = 0L;

  ALLOCV_END(wchannelBuf);
  ALLOCV_END(wpathBuf);

  return Qnil;
}

Instance Method Details

#each ⇒ Object

# File 'ext/winevt/winevt_query.c', line 235

static VALUE
rb_winevt_query_each(VALUE self)
{
  struct WinevtQuery *winevtQuery;

  RETURN_ENUMERATOR(self, 0, 0);

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  while (rb_winevt_query_next(self)) {
    rb_yield_values(3,
                    rb_winevt_query_render(self),
                    rb_winevt_query_message(self),
                    rb_winevt_query_string_inserts(self));
  }

  return Qnil;
}

#message ⇒ Object

# File 'ext/winevt/winevt_query.c', line 157

static VALUE
rb_winevt_query_message(VALUE self)
{
  WCHAR* wResult;
  char* result;
  struct WinevtQuery *winevtQuery;
  VALUE utf8str;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
  wResult = get_description(winevtQuery->event);
  result = wstr_to_mbstr(CP_UTF8, wResult, -1);

  utf8str = rb_utf8_str_new_cstr(result);
  free_allocated_mbstr(result);

  return utf8str;
}

#next ⇒ Object

# File 'ext/winevt/winevt_query.c', line 117

static VALUE
rb_winevt_query_next(VALUE self)
{
  EVT_HANDLE event;
  ULONG      count;
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  if (EvtNext(winevtQuery->query, 1, &event, INFINITE, 0, &count) != FALSE) {
    winevtQuery->event = event;
    winevtQuery->count = count;

    return Qtrue;
  }

  return Qfalse;
}

#offset(offset) ⇒ Object

# File 'ext/winevt/winevt_query.c', line 73

static VALUE
rb_winevt_query_get_offset(VALUE self, VALUE offset)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  return LONG2NUM(winevtQuery->offset);
}

#offset=(offset) ⇒ Object

# File 'ext/winevt/winevt_query.c', line 83

static VALUE
rb_winevt_query_set_offset(VALUE self, VALUE offset)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  winevtQuery->offset = NUM2LONG(offset);

  return Qnil;
}

#render ⇒ Object

# File 'ext/winevt/winevt_query.c', line 137

static VALUE
rb_winevt_query_render(VALUE self)
{
  WCHAR* wResult;
  char* result;
  struct WinevtQuery *winevtQuery;
  VALUE utf8str;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
  wResult = render_event(winevtQuery->event, EvtRenderEventXml);
  result = wstr_to_mbstr(CP_UTF8, wResult, -1);

  utf8str = rb_utf8_str_new_cstr(result);
  free_allocated_mbstr(result);
  if (wResult != NULL)
    free(wResult);

  return utf8str;
}

#seek(bookmark_or_flag) ⇒ Object

# File 'ext/winevt/winevt_query.c', line 201

static VALUE
rb_winevt_query_seek(VALUE self, VALUE bookmark_or_flag)
{
  struct WinevtQuery *winevtQuery;
  struct WinevtBookmark *winevtBookmark = NULL;
  DWORD flag;

  switch (TYPE(bookmark_or_flag)) {
  case T_SYMBOL:
    flag = get_evt_seek_flag_from_cstr(RSTRING_PTR(rb_sym2str(bookmark_or_flag)));
    break;
  case T_STRING:
    flag = get_evt_seek_flag_from_cstr(StringValueCStr(bookmark_or_flag));
    break;
  default:
    if (!rb_obj_is_kind_of(bookmark_or_flag, rb_cBookmark))
      rb_raise(rb_eArgError, "Expected a String or a Symbol or a Bookmark instance");

    winevtBookmark = EventBookMark(bookmark_or_flag);
  }

  if (winevtBookmark) {
    TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
    if (EvtSeek(winevtQuery->query, winevtQuery->offset, winevtBookmark->bookmark, winevtQuery->timeout, EvtSeekRelativeToBookmark))
      return Qtrue;
  } else {
    TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
    if (EvtSeek(winevtQuery->query, winevtQuery->offset, NULL, winevtQuery->timeout, flag))
      return Qtrue;
  }

  return Qfalse;
}

#string_inserts ⇒ Object

# File 'ext/winevt/winevt_query.c', line 175

static VALUE
rb_winevt_query_string_inserts(VALUE self)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
  return get_values(winevtQuery->event);
}

#timeout(timeout) ⇒ Object

# File 'ext/winevt/winevt_query.c', line 95

static VALUE
rb_winevt_query_get_timeout(VALUE self, VALUE timeout)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  return LONG2NUM(winevtQuery->timeout);
}

#timeout=(timeout) ⇒ Object

# File 'ext/winevt/winevt_query.c', line 105

static VALUE
rb_winevt_query_set_timeout(VALUE self, VALUE timeout)
{
  struct WinevtQuery *winevtQuery;

  TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);

  winevtQuery->timeout = NUM2LONG(timeout);

  return Qnil;
}