Class: Winevt::EventLog::Subscribe

Inherits:
Object
  • Object
show all
Defined in:
ext/winevt/winevt_subscribe.c,
lib/winevt/subscribe.rb,
ext/winevt/winevt.c,
ext/winevt/winevt_subscribe.c

Overview

Subscribe Windows EventLog channel.

Examples:

require 'winevt'

@subscribe = Winevt::EventLog::Subscribe.new
@subscribe.tail = true
@subscribe.rate_limit = 80
@subscribe.subscribe(
  "Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"
)
while true do
  @subscribe.each do |eventlog, message, string_inserts|
    puts ({eventlog: eventlog, data: message})
  end
  sleep(0.1)
end

See Also:

Defined Under Namespace

Classes: RemoteHandlerError, SubscribeHandlerError

Constant Summary collapse

RATE_INFINITE =

For Subscribe#rate_limit=. It represents unspecified rate limit.

Since:

  • 0.6.0

SUBSCRIBE_RATE_INFINITE

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Subscribe

Initalize Subscribe class.



98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
 
# File 'ext/winevt/winevt_subscribe.c', line 98

static VALUE
rb_winevt_subscribe_initialize(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->rateLimit = SUBSCRIBE_RATE_INFINITE;
  winevtSubscribe->lastTime = 0;
  winevtSubscribe->currentRate = 0;
  winevtSubscribe->renderAsXML = TRUE;
  winevtSubscribe->readExistingEvents = TRUE;
  winevtSubscribe->preserveQualifiers = FALSE;
  winevtSubscribe->localeInfo = &default_locale;

  return Qnil;
}

Instance Method Details

#bookmark ⇒ String

This method renders bookmark content which is related to Subscribe class instance.

Returns:

  • (String) 


509
510
511
512
513
514
515
516
517
518
 
# File 'ext/winevt/winevt_subscribe.c', line 509

static VALUE
rb_winevt_subscribe_get_bookmark(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return render_to_rb_str(winevtSubscribe->bookmark, EvtRenderBookmark);
}

#cancel ⇒ Boolean

This method cancels channel subscription.

Returns:

  • (Boolean)

Since:

  • 0.9.1



683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
 
# File 'ext/winevt/winevt_subscribe.c', line 683

static VALUE
rb_winevt_subscribe_cancel(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;
  BOOL result = FALSE;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  if (winevtSubscribe->subscription) {
    result = EvtCancel(winevtSubscribe->subscription);
  }

  if (result) {
    return Qtrue;
  } else {
    return Qfalse;
  }
}

#close ⇒ Object

This method closes channel handles forcibly.

Since:

  • 0.9.1



708
709
710
711
712
713
714
715
716
717
718
719
 
# File 'ext/winevt/winevt_subscribe.c', line 708

static VALUE
rb_winevt_subscribe_close(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  close_handles(winevtSubscribe);

  return Qnil;
}

#each {|String, String, String| ... } ⇒ Object

Enumerate to obtain Windows EventLog contents.

This method yields the following: (Stringified EventLog, Stringified detail message, Stringified insert values)

Yields:

  • (String, String, String) 


491
492
493
494
495
496
497
498
499
500
501
502
 
# File 'ext/winevt/winevt_subscribe.c', line 491

static VALUE
rb_winevt_subscribe_each(VALUE self)
{
  RETURN_ENUMERATOR(self, 0, 0);

  while (rb_winevt_subscribe_next(self)) {
    rb_ensure(
      rb_winevt_subscribe_each_yield, self, rb_winevt_subscribe_close_handle, self);
  }

  return Qnil;
}

#locale ⇒ Object

This method obtains specified locale with [String].

Since:

  • 0.8.0



662
663
664
665
666
667
668
669
670
671
672
673
674
675
 
# File 'ext/winevt/winevt_subscribe.c', line 662

static VALUE
rb_winevt_subscribe_get_locale(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  if (winevtSubscribe->localeInfo->langCode) {
    return rb_str_new2(winevtSubscribe->localeInfo->langCode);
  } else {
    return rb_str_new2(default_locale.langCode);
  }
}

#locale=(rb_locale_str) ⇒ Object

This method specifies locale with [String].

Parameters:

  • rb_locale_str (String)

Since:

  • 0.8.0



641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
 
# File 'ext/winevt/winevt_subscribe.c', line 641

static VALUE
rb_winevt_subscribe_set_locale(VALUE self, VALUE rb_locale_str)
{
  struct WinevtSubscribe* winevtSubscribe;
  LocaleInfo* locale_info = &default_locale;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  locale_info = get_locale_info_from_rb_str(rb_locale_str);

  winevtSubscribe->localeInfo = locale_info;

  return Qnil;
}

#next ⇒ Boolean

Handle the next values. Since v0.6.0, this method is used for testing only. Please use #each instead.

Returns:

  • (Boolean)

See Also:



338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
 
# File 'ext/winevt/winevt_subscribe.c', line 338

static VALUE
rb_winevt_subscribe_next(VALUE self)
{
  EVT_HANDLE hEvents[SUBSCRIBE_ARRAY_SIZE];
  ULONG count = 0;
  DWORD status = ERROR_SUCCESS;
  DWORD dwWait = 0;

  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  if (is_rate_limit_exceeded(winevtSubscribe)) {
    return Qfalse;
  }

  /* If subscription handle is NULL, it should return false. */
  if (!winevtSubscribe->subscription) {
    return Qfalse;
  }

  /* If a signalEvent notifies whether a state of processed event(s)
   * is existing or not.
   * For checking for a result of WaitForSingleObject,
   * we need to raise SubscribeHandlerError exception when
   * WAIT_FAILED is detected for further investigations.
   * Note that we don't need to wait explicitly here.
   * Because this function is inside of each enumerator.
   * So, WaitForSingleObject should return immediately and should be
   * processed with the latter each loops if there is no more items.
   * Just intended to check that there is no errors here. */
  dwWait = WaitForSingleObject(winevtSubscribe->signalEvent, 0);
  if (dwWait == WAIT_FAILED) {
    raise_system_error(rb_eSubscribeHandlerError, GetLastError());
  } else if (dwWait != WAIT_OBJECT_0) {
    return Qfalse;
  }

  if (!EvtNext(winevtSubscribe->subscription,
               SUBSCRIBE_ARRAY_SIZE,
               hEvents,
               INFINITE,
               0,
               &count)) {
    status = GetLastError();
    if (ERROR_CANCELLED == status) {
      return Qfalse;
    }
    if (ERROR_NO_MORE_ITEMS != status) {
      return Qfalse;
    }

    ResetEvent(winevtSubscribe->signalEvent);
  }

  if (status == ERROR_SUCCESS) {
    winevtSubscribe->count = count;
    for (int i = 0; i < count; i++) {
      winevtSubscribe->hEvents[i] = hEvents[i];
      EvtUpdateBookmark(winevtSubscribe->bookmark, winevtSubscribe->hEvents[i]);
    }

    update_to_reflect_rate_limit_state(winevtSubscribe, count);

    return Qtrue;
  }

  return Qfalse;
}

#preserve_qualifiers=(rb_preserve_qualifiers) ⇒ Object

This method specifies whether preserving qualifiers key or not.

Parameters:

  • rb_preserve_qualifiers (Boolean)

Since:

  • 0.7.3



605
606
607
608
609
610
611
612
613
614
615
616
 
# File 'ext/winevt/winevt_subscribe.c', line 605

static VALUE
rb_winevt_subscribe_set_preserve_qualifiers(VALUE self, VALUE rb_preserve_qualifiers)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->preserveQualifiers = RTEST(rb_preserve_qualifiers);

  return Qnil;
}

#preserve_qualifiers? ⇒ Integer

This method returns whether preserving qualifiers or not.

Returns:

  • (Integer)

Since:

  • 0.7.3



624
625
626
627
628
629
630
631
632
633
 
# File 'ext/winevt/winevt_subscribe.c', line 624

static VALUE
rb_winevt_subscribe_get_preserve_qualifiers_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->preserveQualifiers ? Qtrue : Qfalse;
}

#rate_limit ⇒ Integer

This method returns rate limit value.

Returns:

  • (Integer)

Since:

  • 0.6.0



526
527
528
529
530
531
532
533
534
535
 
# File 'ext/winevt/winevt_subscribe.c', line 526

static VALUE
rb_winevt_subscribe_get_rate_limit(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return INT2NUM(winevtSubscribe->rateLimit);
}

#rate_limit=(rb_rate_limit) ⇒ Object

This method specifies rate limit value.

Parameters:

  • rb_rate_limit (Integer) —

    rate_limit value

Since:

  • 0.6.0



543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
 
# File 'ext/winevt/winevt_subscribe.c', line 543

static VALUE
rb_winevt_subscribe_set_rate_limit(VALUE self, VALUE rb_rate_limit)
{
  struct WinevtSubscribe* winevtSubscribe;
  DWORD rateLimit;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  rateLimit = NUM2LONG(rb_rate_limit);

  if ((rateLimit != SUBSCRIBE_RATE_INFINITE) && (rateLimit < 10 || rateLimit % 10)) {
    rb_raise(rb_eArgError, "Specify a multiples of 10 or RATE_INFINITE constant");
  } else {
    winevtSubscribe->rateLimit = rateLimit;
  }

  return Qnil;
}

#read_existing_events=(rb_read_existing_events_p) ⇒ Object

This method specifies whether read existing events or not.

Parameters:

  • rb_read_existing_events_p (Boolean) 


122
123
124
125
126
127
128
129
130
131
132
133
 
# File 'ext/winevt/winevt_subscribe.c', line 122

static VALUE
rb_winevt_subscribe_set_read_existing_events(VALUE self, VALUE rb_read_existing_events_p)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->readExistingEvents = RTEST(rb_read_existing_events_p);

  return Qnil;
}

#read_existing_events? ⇒ Boolean

This method returns whether read existing events or not.

Returns:

  • (Boolean) 


140
141
142
143
144
145
146
147
148
149
 
# File 'ext/winevt/winevt_subscribe.c', line 140

static VALUE
rb_winevt_subscribe_read_existing_events_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->readExistingEvents ? Qtrue : Qfalse;
}

#render_as_xml=(rb_render_as_xml) ⇒ Object

This method specifies whether render as xml or not.

Parameters:

  • rb_render_as_xml (Boolean)

Since:

  • 0.6.0



586
587
588
589
590
591
592
593
594
595
596
597
 
# File 'ext/winevt/winevt_subscribe.c', line 586

static VALUE
rb_winevt_subscribe_set_render_as_xml(VALUE self, VALUE rb_render_as_xml)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  winevtSubscribe->renderAsXML = RTEST(rb_render_as_xml);

  return Qnil;
}

#render_as_xml? ⇒ Boolean

This method returns whether render as xml or not.

Returns:

  • (Boolean)

Since:

  • 0.6.0



569
570
571
572
573
574
575
576
577
578
 
# File 'ext/winevt/winevt_subscribe.c', line 569

static VALUE
rb_winevt_subscribe_render_as_xml_p(VALUE self)
{
  struct WinevtSubscribe* winevtSubscribe;

  TypedData_Get_Struct(
    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);

  return winevtSubscribe->renderAsXML ? Qtrue : Qfalse;
}

#subscribe(path, query, bookmark = nil, session = nil) ⇒ Boolean

Subscribe into a Windows EventLog channel.

Parameters:

  • path (String) —

    Subscribe Channel

  • query (String) —

    Query string for channel

  • bookmark (Bookmark) (defaults to: nil) —

    bookmark Bookmark class instance.

  • session (Session) (defaults to: nil) —

    Session information for remoting access.

Returns:

  • (Boolean) 


162
163
164
165
166
167
168
169
170
171
 
# File 'ext/winevt/winevt_subscribe.c', line 162

def subscribe(path, query, bookmark = nil, session = nil)
  if bookmark.is_a?(Winevt::EventLog::Bookmark) &&
     session.is_a?(Winevt::EventLog::Session)
    subscribe_raw(path, query, bookmark.render, session)
  elsif bookmark.is_a?(Winevt::EventLog::Bookmark)
    subscribe_raw(path, query, bookmark.render)
  else
    subscribe_raw(path, query)
  end
end

#subscribe_raw ⇒ Object 



4
 
# File 'lib/winevt/subscribe.rb', line 4

alias_method :subscribe_raw, :subscribe