Class: Winevt::EventLog::Channel

Inherits:

Object

• Object
• Winevt::EventLog::Channel

Defined in:

ext/winevt/winevt_channel.c,
ext/winevt/winevt_channel.c

Overview

Retrieve Windows EventLog channel name.

Examples:

require 'winevt'
channels = []
@channel = Winevt::EventLog::Channel.new
# If users want to retrieve all channel names that
# including type of Debug and Analytical,
# it should be set as true.
@channel.force_enumerate = false
@channel.each do |channel|
  channels << channel
end
print channels

Instance Method Summary

• #each ⇒ Object
• #force_enumerate ⇒ Object
• #force_enumerate=(rb_force_enumerate_p) ⇒ Object
• #initialize ⇒ Object constructor

Constructor Details

#initialize ⇒ Object

# File 'ext/winevt/winevt_channel.c', line 64

static VALUE
rb_winevt_channel_initialize(VALUE self)
{
  struct WinevtChannel* winevtChannel;

  TypedData_Get_Struct(
    self, struct WinevtChannel, &rb_winevt_channel_type, winevtChannel);

  winevtChannel->force_enumerate = FALSE;

  return Qnil;
}

Instance Method Details

#each ⇒ Object

# File 'ext/winevt/winevt_channel.c', line 194

static VALUE
rb_winevt_channel_each(VALUE self)
{
  EVT_HANDLE hChannels;
  EVT_HANDLE hChannelConfig = NULL;
  struct WinevtChannel* winevtChannel;
  char errBuf[256];
  LPWSTR buffer = NULL;
  DWORD bufferSize = 0;
  DWORD bufferUsed = 0;
  DWORD status = ERROR_SUCCESS;
  VALUE utf8str;

  RETURN_ENUMERATOR(self, 0, 0);

  TypedData_Get_Struct(
    self, struct WinevtChannel, &rb_winevt_channel_type, winevtChannel);

  hChannels = EvtOpenChannelEnum(NULL, 0);

  if (hChannels) {
    winevtChannel->channels = hChannels;
  } else {
    _snprintf_s(errBuf,
                _countof(errBuf),
                _TRUNCATE,
                "Failed to enumerate channels with %lu\n",
                GetLastError());
    rb_raise(rb_eRuntimeError, errBuf);
  }

  while (1) {
    if (!EvtNextChannelPath(winevtChannel->channels, bufferSize, buffer, &bufferUsed)) {
      status = GetLastError();

      if (ERROR_NO_MORE_ITEMS == status) {
        break;
      } else if (ERROR_INSUFFICIENT_BUFFER == status) {
        bufferSize = bufferUsed;
        buffer = (LPWSTR)malloc(bufferSize * sizeof(WCHAR));
        if (buffer) {
          continue;
        } else {
          free(buffer);
          EvtClose(winevtChannel->channels);
          winevtChannel->channels = NULL;
          rb_raise(rb_eRuntimeError, "realloc failed");
        }
      } else {
        free(buffer);
        EvtClose(winevtChannel->channels);
        winevtChannel->channels = NULL;
        _snprintf_s(errBuf,
                    _countof(errBuf),
                    _TRUNCATE,
                    "EvtNextChannelPath failed with %lu.\n",
                    status);
        rb_raise(rb_eRuntimeError, errBuf);
      }
    }
    hChannelConfig = EvtOpenChannelConfig(NULL, buffer, 0);
    if (NULL == hChannelConfig) {
      status = GetLastError();

      free(buffer);
      buffer = NULL;
      bufferSize = 0;

      if (is_resource_exhaustion(status)) {
        EvtClose(winevtChannel->channels);
        winevtChannel->channels = NULL;

        rb_raise(rb_eRuntimeError, "EvtOpenChannelConfig failed with %lu\n", status);
      }

      continue;
    }

    status = is_subscribable_channel_p(hChannelConfig, winevtChannel->force_enumerate);
    EvtClose(hChannelConfig);

    if (is_resource_exhaustion(status)) {
      EvtClose(winevtChannel->channels);
      winevtChannel->channels = NULL;

      free(buffer);
      buffer = NULL;
      bufferSize = 0;

      rb_raise(rb_eRuntimeError, "Failed to read channel configuration with %lu\n", status);
    }

    // Not fatal: Security's configuration cannot be read without elevation, and
    // it is the third channel EvtOpenChannelEnum returns, so raising here
    // truncated the whole enumeration to two channels.
    if (status != ERROR_SUCCESS) {
      free(buffer);
      buffer = NULL;
      bufferSize = 0;

      continue;
    }

    utf8str = wstr_to_rb_str(CP_UTF8, buffer, -1);

    free(buffer);
    buffer = NULL;
    bufferSize = 0;

    rb_yield(utf8str);
  }

  if (winevtChannel->channels) {
    EvtClose(winevtChannel->channels);
    winevtChannel->channels = NULL;
  }

  free(buffer);

  return Qnil;
}

#force_enumerate ⇒ Object

# File 'ext/winevt/winevt_channel.c', line 104

static VALUE
rb_winevt_channel_get_force_enumerate(VALUE self)
{
  struct WinevtChannel* winevtChannel;

  TypedData_Get_Struct(
    self, struct WinevtChannel, &rb_winevt_channel_type, winevtChannel);

  return winevtChannel->force_enumerate ? Qtrue : Qfalse;
}

#force_enumerate=(rb_force_enumerate_p) ⇒ Object

# File 'ext/winevt/winevt_channel.c', line 84

static VALUE
rb_winevt_channel_set_force_enumerate(VALUE self, VALUE rb_force_enumerate_p)
{
  struct WinevtChannel* winevtChannel;

  TypedData_Get_Struct(
    self, struct WinevtChannel, &rb_winevt_channel_type, winevtChannel);

  winevtChannel->force_enumerate = RTEST(rb_force_enumerate_p);

  return Qnil;
}