windows_eventlog_native/
lib.rs

1//! # windows-eventlog-native
2//!
3//! The 0.2 series implements native `EvtQuery` / `EvtNext` / `EvtRender`
4//! iteration and structured XML parsing for local Windows Event Log channels.
5//!
6//! Powers OPSEC self-check: after running a scan, ask the log directly
7//! "did I light up 4624/4625/4648/4662/4768/4769/4776?" without shelling out to
8//! `wevtutil` or `Get-WinEvent`.
9//!
10//! ```no_run
11//! use windows_eventlog_native::{EventLog, QueryDirection};
12//!
13//! # fn go() -> windows_eventlog_native::Result<()> {
14//! let iter = EventLog::query(
15//!     "Application",
16//!     "*[System[TimeCreated[timediff(@SystemTime) <= 3600000]]]",
17//!     QueryDirection::Forward,
18//! )?;
19//! for evt in iter.take(10) {
20//!     let evt = evt?;
21//!     println!("{} {} {}", evt.time_created, evt.event_id, evt.provider);
22//! }
23//! # Ok(()) }
24//! ```
25
26pub mod error;
27pub mod event;
28pub mod query;
29pub mod security;
30
31#[cfg(windows)]
32pub(crate) mod platform;
33
34pub use error::{Error, Result};
35pub use event::{filetime_to_utc, parse_event_xml, rendered_xml, Event};
36pub use query::{EventLog, QueryDirection};
37pub use security::security_audit_by_id;
windows_eventlog_native/lib.rs

windows_eventlog_native/
lib.rs
