windows-eventlog-native 0.1.0-dev

Native EvtQuery/EvtNext/EvtRender/EvtSubscribe wrapper for local Windows Event Log channels.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

#[cfg(not(windows))]
use crate::error::Error;
use crate::error::Result;
use crate::event::Event;

/// Direction to walk the query result set.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum QueryDirection {
    /// Oldest → newest (`EvtQueryForwardDirection`).
    Forward,
    /// Newest → oldest (`EvtQueryReverseDirection`).
    Reverse,
}

/// Public entry point.
///
/// `EventLog` is a zero-sized handle namespace; every method opens its own `EVT_HANDLE`
/// and returns an iterator that owns and closes it on drop.
pub struct EventLog;

impl EventLog {
    /// Open a channel with an XPath filter and stream matching events.
    ///
    /// `channel` is the log name (e.g. `"Application"`, `"Security"`, `"System"`).
    /// `xpath` is a structured-query fragment or `"*"` for everything.
    ///
    /// Security channel access requires membership in **Event Log Readers** or
    /// Administrators.
    pub fn query(
        channel: &str,
        xpath: &str,
        direction: QueryDirection,
    ) -> Result<Box<dyn Iterator<Item = Result<Event>>>> {
        #[cfg(windows)]
        {
            let iter = crate::platform::WinEventIter::open(channel, xpath, direction)?;
            Ok(Box::new(iter))
        }
        #[cfg(not(windows))]
        {
            let _ = (channel, xpath, direction);
            Err(Error::UnsupportedPlatform)
        }
    }
}