eventlogging

Documentation

Overview

Package eventlogging provides access to the Event Logging API that was designed for applications that run on the Windows Server 2003, Windows XP, or Windows 2000 operating system.

It can be used on new versions of Windows (i.e. Windows Vista, Windows 7, Windows Server 2008, Windows Server 2012), but the preferred API for those systems is the Windows Event Log API. See the wineventlog package.

Index

• func RemoveWindowsLineEndings(s string) string
• func UTF16BytesToString(b []byte) (string, int, error)
• type Event
• type FileHandle
• type InsufficientBufferError
  • func (e InsufficientBufferError) Error() string
• type MessageFiles
• type SID
  • func (a SID) String() string
• type SIDType
  • func (st SIDType) String() string

Functions

func RemoveWindowsLineEndings

func RemoveWindowsLineEndings(s string) string

RemoveWindowsLineEndings replaces CRLF with LF and trims any newline character that may exist at the end of the string.

func UTF16BytesToString

func UTF16BytesToString(b []byte) (string, int, error)

UTF16BytesToString returns the Unicode code point sequence represented by the UTF-16 buffer b.

Types

type Event

type Event struct {
	RecordID      uint32     `json:",omitempty"`
	TimeGenerated *time.Time `json:",omitempty"`
	TimeWritten   *time.Time `json:",omitempty"`
	EventID       uint32     `json:",omitempty"`
	Level         string     `json:",omitempty"`
	SourceName    string     `json:",omitempty"`
	Computer      string     `json:",omitempty"`

	UserSID    *SID `json:",omitempty"`
	UserSIDErr error

	// Strings that must be resolved by DLL lookups.
	Message  string `json:",omitempty"`
	Category string `json:",omitempty"`

	MessageInserts []string // Strings inserted into a message template to
	// create Message.
	MessageErr error // Possible error that occurred while formatting Message.
}

type FileHandle

type FileHandle struct {
	File   string  // Fully-qualified path to the event message file.
	Handle uintptr // Handle to the loaded event message file.
	Err    error   // Error that occurred while loading Handle.
}

FileHandle contains the handle to a single Windows message file.

type InsufficientBufferError

type InsufficientBufferError struct {
	Cause        error
	RequiredSize int // Size of the buffer that is required.
}

InsufficientBufferError indicates the buffer passed to a system call is too small.

func (InsufficientBufferError) Error

func (e InsufficientBufferError) Error() string

type MessageFiles

type MessageFiles struct {
	SourceName string
	Err        error
	Handles    []FileHandle
}

MessageFiles contains handles to event message files associated with an event log source.

type SID

type SID struct {
	Identifier string
	Name       string
	Domain     string
	Type       SIDType
}

SID represents the Windows Security Identifier for an account.

func (SID) String

func (a SID) String() string

String returns string representation of SID.

type SIDType

type SIDType uint32

SIDType identifies the type of a security identifier (SID).

const (
	// Do not reorder.
	SidTypeUser SIDType = 1 + iota
	SidTypeGroup
	SidTypeDomain
	SidTypeAlias
	SidTypeWellKnownGroup
	SidTypeDeletedAccount
	SidTypeInvalid
	SidTypeUnknown
	SidTypeComputer
	SidTypeLabel
)

SIDType values.

func (SIDType) String

func (st SIDType) String() string

String returns string representation of SIDType.