windows_eventlog_native/
query.rs

1#[cfg(not(windows))]
2use crate::error::Error;
3use crate::error::Result;
4use crate::event::Event;
5
6/// Direction to walk the query result set.
7#[derive(Debug, Clone, Copy, PartialEq, Eq)]
8pub enum QueryDirection {
9    /// Oldest → newest (`EvtQueryForwardDirection`).
10    Forward,
11    /// Newest → oldest (`EvtQueryReverseDirection`).
12    Reverse,
13}
14
15/// Public entry point.
16///
17/// `EventLog` is a zero-sized handle namespace; every method opens its own `EVT_HANDLE`
18/// and returns an iterator that owns and closes it on drop.
19pub struct EventLog;
20
21impl EventLog {
22    /// Open a channel with an XPath filter and stream matching events.
23    ///
24    /// `channel` is the log name (e.g. `"Application"`, `"Security"`, `"System"`).
25    /// `xpath` is a structured-query fragment or `"*"` for everything.
26    ///
27    /// Security channel access requires membership in **Event Log Readers** or
28    /// Administrators.
29    pub fn query(
30        channel: &str,
31        xpath: &str,
32        direction: QueryDirection,
33    ) -> Result<Box<dyn Iterator<Item = Result<Event>>>> {
34        #[cfg(windows)]
35        {
36            let iter = crate::platform::WinEventIter::open(channel, xpath, direction)?;
37            Ok(Box::new(iter))
38        }
39        #[cfg(not(windows))]
40        {
41            let _ = (channel, xpath, direction);
42            Err(Error::UnsupportedPlatform)
43        }
44    }
45}
windows_eventlog_native/query.rs

windows_eventlog_native/
query.rs
