class Fluent::WinEvtLog::WindowsLogWatcher
Attributes
ch[R]
pe[RW]
unwatched[RW]
Public Class Methods
new(interval, ch, pe, &receive_lines)
click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 133 def initialize(interval, ch, pe, &receive_lines) @ch = ch @pe = pe || MemoryPositionEntry.new @receive_lines = receive_lines @timer_trigger = TimerWatcher.new(interval, true, &method(:on_notify)) end
Public Instance Methods
attach(loop)
click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 144 def attach(loop) @timer_trigger.attach(loop) on_notify end
close()
click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 153 def close detach end
detach()
click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 149 def detach @timer_trigger.detach if @timer_trigger.attached? end
on_notify()
click to toggle source
# File lib/fluent/plugin/in_winevtlog.rb, line 157 def on_notify el = EventLog.open(@ch) rl_sn = [el.oldest_record_number, el.total_records] pe_sn = [@pe.read_start, @pe.read_num] # if total_records is zero, oldest_record_number has no meaning. if rl_sn[1] == 0 return end if pe_sn[0] == 0 && pe_sn[1] == 0 @pe.update(rl_sn[0], rl_sn[1]) return end cur_end = rl_sn[0] + rl_sn[1] -1 old_end = pe_sn[0] + pe_sn[1] -1 if (rl_sn[0] < pe_sn[0]) # may be a record number rotated. cur_end += 0xFFFFFFFF end if (cur_end < old_end) # something occured. @pe.update(rl_sn[0], rl_sn[1]) return end read_more = false begin numlines = cur_end - old_end winlogs = el.read(Win32::EventLog::SEEK_READ | Win32::EventLog::FORWARDS_READ, old_end + 1) @receive_lines.call(@ch, winlogs, pe_sn) @pe.update(pe_sn[0], pe_sn[1]) old_end = pe_sn[0] + pe_sn[1] -1 end while read_more el.close end