eventlog

Documentation

Overview

Package eventlog provides the means for reading event logs from Windows. Windows has two different APIs for reading event logs. This package automatically chooses the appropriate API to use based on what is available in the runtime operating system.

Index

• func Register(apiName string, priority int, producer producer, channels channels)
• type Config
• type EventLog
  • func New(config Config) (EventLog, error)
• type Record
  • func (e Record) ToMapStr() common.MapStr

Functions

func Register

func Register(apiName string, priority int, producer producer, channels channels)

Register registers an EventLog API. Only the APIs that are available for the runtime OS should be registered. Each API must have a unique priority.

Types

type Config

type Config struct {
	Name                 string // Name of the event log or channel.
	RemoteAddress        string // Remote computer to connect to. Optional.
	common.EventMetadata        // Fields and tags to add to each event.

	API string // Name of the API to use. Optional.
}

Config is the configuration data used to instantiate a new EventLog.

type EventLog

type EventLog interface {
	// Open the event log. recordNumber is the last successfully read event log
	// record number. Read will resume from recordNumber + 1. To start reading
	// from the first event specify a recordNumber of 0.
	Open(recordNumber uint64) error

	// Read records from the event log.
	Read() ([]Record, error)

	// Close the event log. It should not be re-opened after closing.
	Close() error

	// Name returns the event log's name.
	Name() string
}

EventLog is an interface to a Windows Event Log.

func New

func New(config Config) (EventLog, error)

New creates and returns a new EventLog instance based on the given config and the registered EventLog producers.

type Record

type Record struct {
	API                  string // The event log API type used to read the record.
	common.EventMetadata        // Fields and tags to add to the event.
	sys.Event
}

Record represents a single event from the log.

func (Record) ToMapStr

func (e Record) ToMapStr() common.MapStr

ToMapStr returns a new MapStr containing the data from this Record.