winlog

README

gowinlog

Go library for subscribing to the Windows Event Log.

Installation

gowinlog uses cgo, so it needs gcc, and evt.h must be available. Installing MinGW-w64 should satisfy both requirements. Make sure the Go architecture and GCC architecture are the same.

Usage

In Go, create a watcher and subscribe to some log channels. Subscriptions can start at the beginning of the log, at the most recent event, or at a bookmark. Events and errors are coerced into Go structs and published on the Event() and Error() channels. Every event includes a Bookmark field which can be stored and used to resume processing at the same point.

package main

import (
  "fmt"
  "github.com/scalingdata/gowinlog"
)

func main() {
  watcher, err := winlog.NewWinLogWatcher()
  if err != nil {
    fmt.Printf("Couldn't create watcher: %v\n", err)
    return
  }
  // Recieve any future messages
  watcher.SubscribeFromNow("Application")
  for {
    select {
    case evt := <- watcher.Event():
      // Print the event struct
      fmt.Printf("Event: %v\n", evt)
      // Print the updated bookmark for that channel
      fmt.Printf("Bookmark XML: %v\n", evt.Bookmark)
    case err := <- watcher.Error():
      fmt.Printf("Error: %v\n\n", err)
    }
  }
}

Low-level API

event.go contains wrappers around the C events API. bookmark.go has wrappers around the bookmark API.

Documentation

Index

• type BookmarkHandle
• type EventHandle
• type ListenerHandle
• type LogEventCallback
• type LogEventCallbackWrapper
• type PublisherHandle
• type RenderedFields
• type SysRenderContext
• type WinLogEvent
• type WinLogWatcher

Types

type BookmarkHandle

type BookmarkHandle uint64

type EventHandle

type EventHandle uint64

type ListenerHandle

type ListenerHandle uint64

type LogEventCallback

type LogEventCallback interface {
	PublishError(error)
	PublishEvent(EventHandle, string)
}

type LogEventCallbackWrapper

type LogEventCallbackWrapper struct {
	// contains filtered or unexported fields
}

type PublisherHandle

type PublisherHandle uint64

type RenderedFields

type RenderedFields unsafe.Pointer

type SysRenderContext

type SysRenderContext uint64

type WinLogEvent

type WinLogEvent struct {
	// From EvtRender
	ProviderName      string
	EventId           uint64
	Qualifiers        uint64
	Level             uint64
	Task              uint64
	Opcode            uint64
	Created           time.Time
	RecordId          uint64
	ProcessId         uint64
	ThreadId          uint64
	Channel           string
	ComputerName      string
	Version           uint64
	RenderedFieldsErr error

	// From EvtFormatMessage
	Msg                string
	LevelText          string
	TaskText           string
	OpcodeText         string
	Keywords           []string
	ChannelText        string
	ProviderText       string
	IdText             string
	PublisherHandleErr error

	// XML body
	Xml    string
	XmlErr error

	// Serialied XML bookmark to
	// restart at this event
	Bookmark string

	// Subscribed channel from which the event was retrieved,
	// which may be different than the event's channel
	SubscribedChannel string
}

Stores the common fields from a log event

type WinLogWatcher

type WinLogWatcher struct {
	// contains filtered or unexported fields
}

Watches one or more event log channels and publishes events and errors to Go channels