eventlog

Documentation

Overview

Package eventlog provides access to the Event Logging API used in Windows 2000, Windows XP, and Windows Server 2003. This is distinct from the Windows Event Log API that was introduced in Windows Vista and Windows 2008.

TODO: Provide methods to access the newer Windows Event Log API.

Index

• Constants
• type EventLoggingAPI
  • func NewEventLoggingAPI(eventLogName string) EventLoggingAPI
  • func NewRemoteEventLoggingAPI(uncServerPath, eventLogName string) EventLoggingAPI
• type EventType
  • func (et EventType) String() string
• type Handle
• type LogRecord
  • func (lr LogRecord) String() string
  • func (lr LogRecord) ToMapStr() common.MapStr
• type SID
  • func (a SID) String() string
• type SIDType
  • func (st SIDType) String() string

Constants

const (
	// Do not reorder.
	EVENTLOG_SUCCESS    EventType = 0
	EVENTLOG_ERROR_TYPE           = 1 << (iota - 1)
	EVENTLOG_WARNING_TYPE
	EVENTLOG_INFORMATION_TYPE
	EVENTLOG_AUDIT_SUCCESS
	EVENTLOG_AUDIT_FAILURE
)

EventType values.

Types

type EventLoggingAPI

type EventLoggingAPI interface {
	// Open the event log. recordNumber is the last successfully read event log
	// record number. Read will resume from recordNumber + 1. To start reading
	// from the first event specify a recordNumber of 0.
	Open(recordNumber uint32) error

	// Read records from the event log.
	Read() ([]LogRecord, error)

	// Close the event log. It should not be re-opened after closing.
	Close() error

	// Name returns the event log's name. If the name is unknown to the host
	// system, then the Application event log is opened.
	Name() string
}

EventLoggingAPI provides an interface to the Event Logging API introduced in Windows 2000 (not the Windows Event Log API that was introduced in Windows Vista).

func NewEventLoggingAPI

func NewEventLoggingAPI(eventLogName string) EventLoggingAPI

func NewRemoteEventLoggingAPI

func NewRemoteEventLoggingAPI(uncServerPath, eventLogName string) EventLoggingAPI

type EventType

type EventType uint16

EventType identifies the five types of events that can be logged by applications.

func (EventType) String

func (et EventType) String() string

String returns string representation of EventType.

type Handle

type Handle struct {
	// contains filtered or unexported fields
}

type LogRecord

type LogRecord struct {
	EventLogName  string
	SourceName    string
	ComputerName  string
	RecordNumber  uint32
	EventID       uint32
	EventType     EventType
	EventCategory string
	TimeGenerated time.Time
	TimeWritten   time.Time
	UserSID       *SID
	Message       string
}

LogRecord represents a single record from an event log.

func (LogRecord) String

func (lr LogRecord) String() string

String returns string representation of LogRecord.

func (LogRecord) ToMapStr

func (lr LogRecord) ToMapStr() common.MapStr

type SID

type SID struct {
	Name    string
	Domain  string
	SIDType SIDType
}

SID represents the Windows Security Identifier for an account.

func (SID) String

func (a SID) String() string

String returns string representation of SID.

type SIDType

type SIDType uint32

SIDType identifies the type of a security identifier (SID).

const (
	// Do not reorder.
	SidTypeUser SIDType = 1 + iota
	SidTypeGroup
	SidTypeDomain
	SidTypeAlias
	SidTypeWellKnownGroup
	SidTypeDeletedAccount
	SidTypeInvalid
	SidTypeUnknown
	SidTypeComputer
	SidTypeLabel
)

SIDType values.

func (SIDType) String

func (st SIDType) String() string

String returns string representation of SIDType.