win_eventlog

package

Go to main page

Versions in this module

v3

v3.3.2

Dec 18, 2024

v3.3.1

Dec 4, 2024

v3.3.0

Nov 19, 2024

v3.2.2

Dec 4, 2024

v3.2.1

Oct 17, 2024

v3.2.0

Sep 18, 2024

v3.1.2

Oct 17, 2024

v3.1.1

Aug 8, 2024

v3.1.0

Jul 2, 2024

v3.0.1

Aug 9, 2024

v3.0.0

Apr 8, 2024

Changes in this version

+ const ERROR_INSUFFICIENT_BUFFER — windows/amd64

+ const ERROR_INVALID_OPERATION — windows/amd64

+ const ERROR_NO_MORE_ITEMS — windows/amd64

+ func Close(handles []EvtHandle) error — windows/amd64

+ func DecodeUTF16(b []byte) ([]byte, error) — windows/amd64

+ func GetFromSnapProcess(pid uint32) (uint32, uint32, string, error) — windows/amd64

+ func UpdateBookmark(bookmark, event EvtHandle, buf []byte) (string, error) — windows/amd64

+ type Correlation struct — windows/amd64

+ ActivityID string

+ RelatedActivityID string

+ type Event struct — windows/amd64

+ Channel string

+ Computer string

+ Correlation Correlation

+ EventData EventData

+ EventID int

+ EventRecordID int

+ Execution Execution

+ Keywords string

+ Level int

+ LevelText string

+ Message string

+ Opcode int

+ OpcodeText string

+ Security Security

+ Source Provider

+ Task int

+ TaskText string

+ TimeCreated TimeCreated

+ UserData UserData

+ Version int

+ type EventData struct — windows/amd64

+ InnerXML []byte

+ type EventFetcher struct — windows/amd64

+ func NewEventFetcher() *EventFetcher

+ func (w *EventFetcher) FetchEvents(subsHandle EvtHandle, lang uint32) ([]Event, []EvtHandle, error)

+ type EventField struct — windows/amd64

+ Name string

+ Value string

+ func UniqueFieldNames(fields []EventField, fieldsUsage map[string]int, separator string) []EventField

+ func UnrollXMLFields(data []byte, fieldsUsage map[string]int, separator string) ([]EventField, map[string]int)

+ type EvtFormatMessageFlag uint32 — windows/amd64

+ const EvtFormatMessageEvent

+ const EvtFormatMessageKeyword

+ const EvtFormatMessageLevel

+ const EvtFormatMessageOpcode

+ const EvtFormatMessageTask

+ type EvtHandle uintptr — windows/amd64

+ func CreateBookmark(bookmark string) (EvtHandle, error)

+ func EvtSubscribe(logName, xquery string) (EvtHandle, error)

+ func EvtSubscribeWithBookmark(logName, xquery string, bookMark EvtHandle) (EvtHandle, error)

+ type EvtRenderFlag uint32 — windows/amd64

+ const EvtRenderBookmark

+ const EvtRenderEventXml

+ type EvtSubscribeFlag uint32 — windows/amd64

+ const EvtSubscribeStartAfterBookmark

+ const EvtSubscribeToFutureEvents

+ type Execution struct — windows/amd64

+ ProcessID uint32

+ ProcessName string

+ ThreadID uint32

+ type Provider struct — windows/amd64

+ Name string

+ type Security struct — windows/amd64

+ UserID string

+ type TimeCreated struct — windows/amd64

+ SystemTime string

+ type UserData struct — windows/amd64

+ InnerXML []byte

+ type WinEventLog struct — windows/amd64

+ EventFields []string

+ EventTags []string

+ EventlogName string

+ ExcludeEmpty []string

+ ExcludeFields []string

+ Locale uint32

+ OnlyFirstLineOfMessage bool

+ ProcessEventData bool

+ ProcessUserData bool

+ Query string

+ Separator string

+ TimeStampFromEvent bool

+ func (w *WinEventLog) Description() string

+ func (w *WinEventLog) Gather(acc telegraf.Accumulator) error

+ func (w *WinEventLog) SampleConfig() string

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL