evtsession

Documentation

Overview

Package evtsession provides helpers for managing an Event Log API session https://learn.microsoft.com/en-us/windows/win32/wes/accessing-remote-computers

Index

• type Session
  • func New(api evtapi.API) Session
  • func NewRemote(api evtapi.API, server string, user string, domain string, password string, ...) (Session, error)

Types

type Session

type Session interface {
	// Close closes the session with the target host
	//
	// Close will automatically close any open handles created in the session,
	// so you must not use any subscription or event record handles after closing the session.
	// https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtopensession
	// https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtclose
	Close()

	// Handle returns the underlying handle returned by EvtOpenSession
	Handle() evtapi.EventSessionHandle
}

Session defines the interface for connecting to an Event Log host and is used to manage event logs and query, subscribe, and render events.

The Event Log API manages the connection behind the session handle. The connection to the remote host is only made when the session is first used (e.g. EvtSubscribe). If the remote host or the remote EventLog service is restarted the session handle does not need to be closed and re-created.

https://learn.microsoft.com/en-us/windows/win32/wes/accessing-remote-computers https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtopensession

func New

func New(api evtapi.API) Session

New creates a new session to the local event log service

func NewRemote

func NewRemote(
	api evtapi.API,
	server string,
	user string,
	domain string,
	password string,
	flags uint,
) (Session, error)

NewRemote creates a new session to a remote event log service