Class: Winevt::EventLog::Bookmark

Inherits:
Object
  • Object
show all
Defined in:
ext/winevt/winevt_bookmark.c,
lib/winevt/bookmark.rb,
ext/winevt/winevt_bookmark.c

Overview

Bookmark for querying/subscribing Windows EventLog progress.

Examples:

require 'winevt'

@query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
@bookmark = Winevt::EventLog::Bookmark.new
@query.each do |xml|
  @bookmark.update(@query)
end

puts @bookmark.render

Instance Method Summary collapse

Constructor Details

#initialize(*args) ⇒ Object 



64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
 
# File 'ext/winevt/winevt_bookmark.c', line 64

static VALUE
rb_winevt_bookmark_initialize(int argc, VALUE* argv, VALUE self)
{
  PWSTR bookmarkXml;
  VALUE wbookmarkXmlBuf;
  DWORD len;
  struct WinevtBookmark* winevtBookmark;

  TypedData_Get_Struct(
    self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);

  if (argc == 0) {
    winevtBookmark->bookmark = EvtCreateBookmark(NULL);
  } else if (argc == 1) {
    VALUE rb_bookmarkXml;
    rb_scan_args(argc, argv, "10", &rb_bookmarkXml);
    Check_Type(rb_bookmarkXml, T_STRING);

    // bookmarkXml : To wide char
    len = MultiByteToWideChar(
      CP_UTF8, 0, RSTRING_PTR(rb_bookmarkXml), RSTRING_LEN(rb_bookmarkXml), NULL, 0);
    bookmarkXml = ALLOCV_N(WCHAR, wbookmarkXmlBuf, len + 1);
    MultiByteToWideChar(CP_UTF8,
                        0,
                        RSTRING_PTR(rb_bookmarkXml),
                        RSTRING_LEN(rb_bookmarkXml),
                        bookmarkXml,
                        len);
    bookmarkXml[len] = L'\0';
    winevtBookmark->bookmark = EvtCreateBookmark(bookmarkXml);
    ALLOCV_END(wbookmarkXmlBuf);
  }

  return Qnil;
}

Instance Method Details

#render ⇒ Object 



133
134
135
136
137
138
139
140
141
142
 
# File 'ext/winevt/winevt_bookmark.c', line 133

static VALUE
rb_winevt_bookmark_render(VALUE self)
{
  struct WinevtBookmark* winevtBookmark;

  TypedData_Get_Struct(
    self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);

  return render_to_rb_str(winevtBookmark->bookmark, EvtRenderBookmark);
}

#update(event) ⇒ Object 



106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
 
# File 'ext/winevt/winevt_bookmark.c', line 106

static VALUE
rb_winevt_bookmark_update(VALUE self, VALUE event)
{
  struct WinevtQuery* winevtQuery;
  struct WinevtBookmark* winevtBookmark;

  if (!rb_obj_is_kind_of(event, rb_cQuery)) {
    rb_raise(rb_eArgError, "Expected a Query instance");
  }

  winevtQuery = EventQuery(event);

  TypedData_Get_Struct(
    self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);

  for (ULONG i = 0; i < winevtQuery->count; i++) {
    if (!EvtUpdateBookmark(winevtBookmark->bookmark, winevtQuery->hEvents[i]))
      return Qfalse;
  }
  return Qtrue;
}