Class: Winevt::EventLog::Subscribe

Inherits:
Object
  • Object
show all
Defined in:
ext/winevt/winevt_subscribe.c,
lib/winevt/subscribe.rb,
ext/winevt/winevt.c,
ext/winevt/winevt_subscribe.c

Overview

Subscribe Windows EventLog channel.

Examples:

require 'winevt'

@subscribe = Winevt::EventLog::Subscribe.new
@subscribe.tail = true
@subscribe.rate_limit = 80
@subscribe.subscribe(
  "Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"
)
while true do
  @subscribe.each do |eventlog, message, string_inserts|
    puts ({eventlog: eventlog, data: message})
  end
  sleep(0.1)
end

See Also:

Defined Under Namespace

Classes: RemoteHandlerError, SubscribeHandlerError

Constant Summary collapse

RATE_INFINITE =

For Subscribe#rate_limit=. It represents unspecified rate limit.

Since:

  • 0.6.0

SUBSCRIBE_RATE_INFINITE

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Subscribe

Initalize Subscribe class.



98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
 
# File 'ext/winevt/winevt_subscribe.c', line 98

static VALUE
rb_winevt_subscribe_initialize(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->rateLimit = SUBSCRIBE_RATE_INFINITE;
  winevtSubscribe->lastTime = 0;
  winevtSubscribe->currentRate = 0;
  winevtSubscribe->renderAsXML = TRUE;
  winevtSubscribe->readExistingEvents = TRUE;
  winevtSubscribe->preserveQualifiers = FALSE;
  winevtSubscribe->localeInfo = &default_locale;
  winevtSubscribe->preserveSID = TRUE;

  return Qnil;
}

Instance Method Details

#bookmark ⇒ String

This method renders bookmark content which is related to Subscribe class instance.

Returns:

  • (String) 


515
516
517
518
519
520
521
522
523
524
 
# File 'ext/winevt/winevt_subscribe.c', line 515

static VALUE
rb_winevt_subscribe_get_bookmark(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return render_to_rb_str(winevtSubscribe->bookmark, EvtRenderBookmark);
}

#cancel ⇒ Boolean

This method cancels channel subscription.

Returns:

  • (Boolean)

Since:

  • 0.9.1



723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
 
# File 'ext/winevt/winevt_subscribe.c', line 723

static VALUE
rb_winevt_subscribe_cancel(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;
  BOOL result = FALSE;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  if (winevtSubscribe->subscription) {
    result = EvtCancel(winevtSubscribe->subscription);
  }

  if (result) {
    return Qtrue;
  } else {
    return Qfalse;
  }
}

#close ⇒ Object

This method closes channel handles forcibly.

Since:

  • 0.9.1



748
749
750
751
752
753
754
755
756
757
758
759
 
# File 'ext/winevt/winevt_subscribe.c', line 748

static VALUE
rb_winevt_subscribe_close(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  close_handles(winevtSubscribe);

  return Qnil;
}

#each {|String, String, String| ... } ⇒ Object

Enumerate to obtain Windows EventLog contents.

This method yields the following: (Stringified EventLog, Stringified detail message, Stringified insert values)

Yields:

  • (String, String, String) 


497
498
499
500
501
502
503
504
505
506
507
508
 
# File 'ext/winevt/winevt_subscribe.c', line 497

static VALUE
rb_winevt_subscribe_each(VALUE self)
{
  RETURN_ENUMERATOR(self, 0, 0);

  while (rb_winevt_subscribe_next(self)) {
    rb_ensure(
      rb_winevt_subscribe_each_yield, self, rb_winevt_subscribe_close_handle, self);
  }

  return Qnil;
}

#locale ⇒ Object

This method obtains specified locale with [String].

Since:

  • 0.8.0



668
669
670
671
672
673
674
675
676
677
678
679
680
681
 
# File 'ext/winevt/winevt_subscribe.c', line 668

static VALUE
rb_winevt_subscribe_get_locale(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  if (winevtSubscribe->localeInfo->langCode) {
    return rb_str_new2(winevtSubscribe->localeInfo->langCode);
  } else {
    return rb_str_new2(default_locale.langCode);
  }
}

#locale=(rb_locale_str) ⇒ Object

This method specifies locale with [String].

Parameters:

  • rb_locale_str (String)

Since:

  • 0.8.0



647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
 
# File 'ext/winevt/winevt_subscribe.c', line 647

static VALUE
rb_winevt_subscribe_set_locale(VALUE self, VALUE rb_locale_str)
{
  struct WinevtSubscribe* winevtSubscribe;
  LocaleInfo* locale_info = &default_locale;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  locale_info = get_locale_info_from_rb_str(rb_locale_str);

  winevtSubscribe->localeInfo = locale_info;

  return Qnil;
}

#next ⇒ Boolean

Handle the next values. Since v0.6.0, this method is used for testing only. Please use #each instead.

Returns:

  • (Boolean)

See Also:



343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
 
# File 'ext/winevt/winevt_subscribe.c', line 343

static VALUE
rb_winevt_subscribe_next(VALUE self)
{
  EVT_HANDLE hEvents[SUBSCRIBE_ARRAY_SIZE];
  ULONG count = 0;
  DWORD status = ERROR_SUCCESS;
  DWORD dwWait = 0;

  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  if (is_rate_limit_exceeded(winevtSubscribe)) {
    return Qfalse;
  }

  /* If subscription handle is NULL, it should return false. */
  if (!winevtSubscribe->subscription) {
    return Qfalse;
  }

  /* If a signalEvent notifies whether a state of processed event(s)
   * is existing or not.
   * For checking for a result of WaitForSingleObject,
   * we need to raise SubscribeHandlerError exception when
   * WAIT_FAILED is detected for further investigations.
   * Note that we don't need to wait explicitly here.
   * Because this function is inside of each enumerator.
   * So, WaitForSingleObject should return immediately and should be
   * processed with the latter each loops if there is no more items.
   * Just intended to check that there is no errors here. */
  dwWait = WaitForSingleObject(winevtSubscribe->signalEvent, 0);
  if (dwWait == WAIT_FAILED) {
    raise_system_error(rb_eSubscribeHandlerError, GetLastError());
  } else if (dwWait != WAIT_OBJECT_0) {
    return Qfalse;
  }

  if (!EvtNext(winevtSubscribe->subscription,
               SUBSCRIBE_ARRAY_SIZE,
               hEvents,
               INFINITE,
               0,
               &count)) {
    status = GetLastError();
    if (ERROR_CANCELLED == status) {
      return Qfalse;
    }
    if (ERROR_NO_MORE_ITEMS != status) {
      return Qfalse;
    }

    ResetEvent(winevtSubscribe->signalEvent);
  }

  if (status == ERROR_SUCCESS) {
    winevtSubscribe->count = count;
    for (int i = 0; i < count; i++) {
      winevtSubscribe->hEvents[i] = hEvents[i];
      EvtUpdateBookmark(winevtSubscribe->bookmark, winevtSubscribe->hEvents[i]);
    }

    update_to_reflect_rate_limit_state(winevtSubscribe, count);

    return Qtrue;
  }

  return Qfalse;
}

#preserve_qualifiers=(rb_preserve_qualifiers) ⇒ Object

This method specifies whether preserving qualifiers key or not.

Parameters:

  • rb_preserve_qualifiers (Boolean)

Since:

  • 0.7.3



611
612
613
614
615
616
617
618
619
620
621
622
 
# File 'ext/winevt/winevt_subscribe.c', line 611

static VALUE
rb_winevt_subscribe_set_preserve_qualifiers(VALUE self, VALUE rb_preserve_qualifiers)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->preserveQualifiers = RTEST(rb_preserve_qualifiers);

  return Qnil;
}

#preserve_qualifiers? ⇒ Integer

This method returns whether preserving qualifiers or not.

Returns:

  • (Integer)

Since:

  • 0.7.3



630
631
632
633
634
635
636
637
638
639
 
# File 'ext/winevt/winevt_subscribe.c', line 630

static VALUE
rb_winevt_subscribe_get_preserve_qualifiers_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->preserveQualifiers ? Qtrue : Qfalse;
}

#preserve_sid=(rb_preserve_sid_p) ⇒ Object

This method specifies whether preserving SID or not.

Parameters:

  • rb_preserve_sid_p (Boolean) 


688
689
690
691
692
693
694
695
696
697
698
699
 
# File 'ext/winevt/winevt_subscribe.c', line 688

static VALUE
rb_winevt_subscribe_set_preserve_sid(VALUE self, VALUE rb_preserve_sid_p)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->preserveSID = RTEST(rb_preserve_sid_p);

  return Qnil;
}

#preserve_sid? ⇒ Boolean

This method returns whether preserving SID or not.

Returns:

  • (Boolean) 


706
707
708
709
710
711
712
713
714
715
 
# File 'ext/winevt/winevt_subscribe.c', line 706

static VALUE
rb_winevt_subscribe_preserve_sid_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->preserveSID ? Qtrue : Qfalse;
}

#rate_limit ⇒ Integer

This method returns rate limit value.

Returns:

  • (Integer)

Since:

  • 0.6.0



532
533
534
535
536
537
538
539
540
541
 
# File 'ext/winevt/winevt_subscribe.c', line 532

static VALUE
rb_winevt_subscribe_get_rate_limit(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return INT2NUM(winevtSubscribe->rateLimit);
}

#rate_limit=(rb_rate_limit) ⇒ Object

This method specifies rate limit value.

Parameters:

  • rb_rate_limit (Integer) —

    rate_limit value

Since:

  • 0.6.0



549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
 
# File 'ext/winevt/winevt_subscribe.c', line 549

static VALUE
rb_winevt_subscribe_set_rate_limit(VALUE self, VALUE rb_rate_limit)
{
  struct WinevtSubscribe* winevtSubscribe;
  DWORD rateLimit;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  rateLimit = NUM2LONG(rb_rate_limit);

  if ((rateLimit != SUBSCRIBE_RATE_INFINITE) && (rateLimit < 10 || rateLimit % 10)) {
    rb_raise(rb_eArgError, "Specify a multiples of 10 or RATE_INFINITE constant");
  } else {
    winevtSubscribe->rateLimit = rateLimit;
  }

  return Qnil;
}

#read_existing_events=(rb_read_existing_events_p) ⇒ Object

This method specifies whether read existing events or not.

Parameters:

  • rb_read_existing_events_p (Boolean) 


123
124
125
126
127
128
129
130
131
132
133
134
 
# File 'ext/winevt/winevt_subscribe.c', line 123

static VALUE
rb_winevt_subscribe_set_read_existing_events(VALUE self, VALUE rb_read_existing_events_p)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->readExistingEvents = RTEST(rb_read_existing_events_p);

  return Qnil;
}

#read_existing_events? ⇒ Boolean

This method returns whether read existing events or not.

Returns:

  • (Boolean) 


141
142
143
144
145
146
147
148
149
150
 
# File 'ext/winevt/winevt_subscribe.c', line 141

static VALUE
rb_winevt_subscribe_read_existing_events_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->readExistingEvents ? Qtrue : Qfalse;
}

#render_as_xml=(rb_render_as_xml) ⇒ Object

This method specifies whether render as xml or not.

Parameters:

  • rb_render_as_xml (Boolean)

Since:

  • 0.6.0



592
593
594
595
596
597
598
599
600
601
602
603
 
# File 'ext/winevt/winevt_subscribe.c', line 592

static VALUE
rb_winevt_subscribe_set_render_as_xml(VALUE self, VALUE rb_render_as_xml)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->renderAsXML = RTEST(rb_render_as_xml);

  return Qnil;
}

#render_as_xml? ⇒ Boolean

This method returns whether render as xml or not.

Returns:

  • (Boolean)

Since:

  • 0.6.0



575
576
577
578
579
580
581
582
583
584
 
# File 'ext/winevt/winevt_subscribe.c', line 575

static VALUE
rb_winevt_subscribe_render_as_xml_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->renderAsXML ? Qtrue : Qfalse;
}

#subscribe(path, query, bookmark = nil, session = nil) ⇒ Boolean

Subscribe into a Windows EventLog channel.

Parameters:

  • path (String) —

    Subscribe Channel

  • query (String) —

    Query string for channel

  • bookmark (Bookmark) (defaults to: nil) —

    bookmark Bookmark class instance.

  • session (Session) (defaults to: nil) —

    Session information for remoting access.

Returns:

  • (Boolean) 


163
164
165
166
167
168
169
170
171
172
 
# File 'ext/winevt/winevt_subscribe.c', line 163

def subscribe(path, query, bookmark = nil, session = nil)
  if bookmark.is_a?(Winevt::EventLog::Bookmark) &&
     session.is_a?(Winevt::EventLog::Session)
    subscribe_raw(path, query, bookmark.render, session)
  elsif bookmark.is_a?(Winevt::EventLog::Bookmark)
    subscribe_raw(path, query, bookmark.render)
  else
    subscribe_raw(path, query)
  end
end

#subscribe_raw ⇒ Object 



4
 
# File 'lib/winevt/subscribe.rb', line 4

alias_method :subscribe_raw, :subscribe