winevtapi

package

v0.54.0-rc.5 Latest Latest Go to latest Published: May 16, 2024 License: Apache-2.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DataDog/datadog-agent

Documentation ¶

Rendered for windows/amd64

Overview ¶

Package winevtapi implements the evtapi.API interface with the Windows Event Log API

Constants ¶

View Source

const (
	EvtRpcLogin = 1
)

EVT_LOGIN_CLASS https://learn.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_login_class

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type API ¶

type API struct{}

API implements Golang wrappers for Windows Event Log API methods https://learn.microsoft.com/en-us/windows/win32/wes/windows-event-log-functions

func New ¶

func New() *API

New returns a new Windows Event Log API

func (*API) DeregisterEventSource ¶

func (api *API) DeregisterEventSource(EventLog evtapi.EventSourceHandle) error

DeregisterEventSource wrapper https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-deregistereventsource

func (*API) EvtClearLog ¶

func (api *API) EvtClearLog(ChannelPath string) error

EvtClearLog wrapper https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtclearlog

func (*API) EvtClose ¶

func (api *API) EvtClose(h windows.Handle)

EvtClose wrapper https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtclose

func (*API) EvtCreateBookmark ¶

func (api *API) EvtCreateBookmark(BookmarkXML string) (evtapi.EventBookmarkHandle, error)

EvtCreateBookmark wrapper https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtcreatebookmark

func (*API) EvtCreateRenderContext ¶

func (api *API) EvtCreateRenderContext(ValuePaths []string, Flags uint) (evtapi.EventRenderContextHandle, error)

EvtCreateRenderContext wrapper https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtcreaterendercontext

func (*API) EvtFormatMessage ¶

func (api *API) EvtFormatMessage(
	PublisherMetadata evtapi.EventPublisherMetadataHandle,
	Event evtapi.EventRecordHandle,
	MessageID uint,
	Values evtapi.EvtVariantValues,
	Flags uint) (string, error)

EvtFormatMessage wrapper https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtformatmessage

func (*API) EvtNext ¶

func (api *API) EvtNext(
	Session evtapi.EventResultSetHandle,
	EventsArray []evtapi.EventRecordHandle,
	EventsSize uint,
	Timeout uint) ([]evtapi.EventRecordHandle, error)

EvtNext wrapper. Must pass on every handle returned to EvtClose when finished using the handle. https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtnext

func (*API) EvtOpenPublisherMetadata ¶

func (api *API) EvtOpenPublisherMetadata(
	PublisherID string,
	LogFilePath string) (evtapi.EventPublisherMetadataHandle, error)

EvtOpenPublisherMetadata wrapper https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtopenpublishermetadata

func (*API) EvtOpenSession ¶

func (api *API) EvtOpenSession(
	Server string,
	User string,
	Domain string,
	Password string,
	Flags uint,
) (evtapi.EventSessionHandle, error)

EvtOpenSession wrapper

NOTE: The connection is not made and the creds are not validated at the time of this call. Those operations occur when the session is first used (e.g. EvtSubscribe)

https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtopensession

func (*API) EvtRenderBookmark ¶

func (api *API) EvtRenderBookmark(Fragment evtapi.EventBookmarkHandle) ([]uint16, error)

EvtRenderBookmark wraps EvtRender with EvtRenderBookmark https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtrender

func (*API) EvtRenderEventValues ¶

func (api *API) EvtRenderEventValues(Context evtapi.EventRenderContextHandle, Fragment evtapi.EventRecordHandle) (evtapi.EvtVariantValues, error)

EvtRenderEventValues renders EvtRenderEventValues https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtrender

func (*API) EvtRenderEventXml ¶

func (api *API) EvtRenderEventXml(Fragment evtapi.EventRecordHandle) ([]uint16, error)

EvtRenderEventXml wraps EvtRender with EvtRenderEventXml https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtrender

func (*API) EvtSubscribe ¶

func (api *API) EvtSubscribe(
	Session evtapi.EventSessionHandle,
	SignalEvent evtapi.WaitEventHandle,
	ChannelPath string,
	Query string,
	Bookmark evtapi.EventBookmarkHandle,
	Flags uint) (evtapi.EventResultSetHandle, error)

EvtSubscribe wrapper. Must pass the returned handle to EvtClose when finished using the handle. https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtsubscribe

func (*API) EvtUpdateBookmark ¶

func (api *API) EvtUpdateBookmark(Bookmark evtapi.EventBookmarkHandle, Event evtapi.EventRecordHandle) error

EvtUpdateBookmark wrapper https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtupdatebookmark

func (*API) RegisterEventSource ¶

func (api *API) RegisterEventSource(SourceName string) (evtapi.EventSourceHandle, error)

RegisterEventSource wrapper https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-registereventsourcew

func (*API) ReportEvent ¶

func (api *API) ReportEvent(
	EventLog evtapi.EventSourceHandle,
	Type uint,
	Category uint,
	EventID uint,
	UserSID *windows.SID,
	Strings []string,
	RawData []uint8) error

ReportEvent wrapper https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-reporteventw

type EVT_RPC_LOGIN ¶

type EVT_RPC_LOGIN struct {
	Server   *uint16
	User     *uint16
	Domain   *uint16
	Password *uint16
	Flags    uint
}

EVT_RPC_LOGIN is a C struct used when calling EvtOpenSession https://learn.microsoft.com/en-us/windows/win32/api/winevt/ns-winevt-evt_rpc_login

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL