class Fluent::WinEvtLog::WindowsLogWatcher

Attributes

ch[R]
pe[RW]
unwatched[RW]

Public Class Methods

new(interval, ch, pe, &receive_lines) click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 133
def initialize(interval, ch, pe, &receive_lines)
  @ch = ch
  @pe = pe || MemoryPositionEntry.new
  @receive_lines = receive_lines
  @timer_trigger = TimerWatcher.new(interval, true, &method(:on_notify))
end

Public Instance Methods

attach(loop) click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 144
def attach(loop)
  @timer_trigger.attach(loop)
  on_notify
end
close() click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 153
def close
  detach
end
detach() click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 149
def detach
  @timer_trigger.detach if @timer_trigger.attached?
end
on_notify() click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 157
def on_notify
  el = EventLog.open(@ch)
  rl_sn = [el.oldest_record_number, el.total_records]
  pe_sn = [@pe.read_start, @pe.read_num]
  # if total_records is zero, oldest_record_number has no meaning.
  if rl_sn[1] == 0
    return
  end
  
  if pe_sn[0] == 0 && pe_sn[1] == 0
    @pe.update(rl_sn[0], rl_sn[1])
    return
  end

  cur_end = rl_sn[0] + rl_sn[1] -1
  old_end = pe_sn[0] + pe_sn[1] -1

  if (rl_sn[0] < pe_sn[0])
    # may be a record number rotated.
    cur_end += 0xFFFFFFFF
  end

  if (cur_end < old_end)
    # something occured.
    @pe.update(rl_sn[0], rl_sn[1])
    return
  end

  read_more = false
  begin
    numlines = cur_end - old_end

    winlogs = el.read(Win32::EventLog::SEEK_READ | Win32::EventLog::FORWARDS_READ, old_end + 1)
    @receive_lines.call(@ch, winlogs, pe_sn)

    @pe.update(pe_sn[0], pe_sn[1])
    old_end = pe_sn[0] + pe_sn[1] -1
  end while read_more
  el.close
  
end