windows_snapshot/operating_system/event_log.rs
1//! The Windows Event Log subcategory groups classes that represent events, event log entries, event log configuration settings, and so on.
2//!
3//! | Class | Description |
4//! |---------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
5//! | [**Win32\_NTEventlogFile**](/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)) | Instance class<br/> Represents data stored in a Windows Event log file.<br/> |
6//! | [**Win32\_NTLogEvent**](win32-ntlogevent) | Instance class<br/> Represents Windows events.<br/> |
7//! | [**Win32\_NTLogEventComputer**](win32-ntlogeventcomputer) | Association class<br/> Relates instances of [**Win32\_NTLogEvent**](/previous-versions/windows/desktop/eventlogprov/win32-ntlogevent) and [**Win32\_ComputerSystem**](win32-computersystem.md).<br/> |
8//! | [**Win32\_NTLogEventLog**](/previous-versions/windows/desktop/eventlogprov/win32-ntlogeventlog) | Association class<br/> Relates instances of [**Win32\_NTLogEvent**](/previous-versions/windows/desktop/eventlogprov/win32-ntlogevent) and [**Win32\_NTEventlogFile**](/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)) classes.<br/> |
9//! | [**Win32\_NTLogEventUser**](/previous-versions/windows/desktop/eventlogprov/win32-ntlogeventuser) | Association class<br/> Relates instances of [**Win32\_NTLogEvent**](/previous-versions/windows/desktop/eventlogprov/win32-ntlogevent) and [**Win32\_UserAccount**](win32-useraccount.md).<br/> |
10
11use crate::update;
12use serde::{Deserialize, Serialize};
13use std::time::SystemTime;
14use wmi::{COMLibrary, WMIConnection, WMIDateTime};
15
16/// Represents the state of Windows NTEventlogFiles
17#[derive(Deserialize, Serialize, Debug, Clone)]
18pub struct NTEventlogFiles {
19 /// Represents data stored in a Windows Event log file
20 pub nt_event_log_files: Vec<Win32_NTEventlogFile>,
21 /// When was the record last updated
22 pub last_updated: SystemTime,
23}
24
25update!(NTEventlogFiles, nt_event_log_files);
26
27/// Represents the state of Windows NTLogEvents
28#[derive(Deserialize, Serialize, Debug, Clone)]
29pub struct NTLogEvents {
30 /// Represents sequence of Windows `NTLogEvents`
31 pub nt_log_events: Vec<Win32_NTLogEvent>,
32 /// When was the record last updated
33 pub last_updated: SystemTime,
34}
35
36update!(NTLogEvents, nt_log_events);
37
38/// The `Win32_NTEventlogFile` WMI class represents a logical file or directory of operating system
39/// events. The file is also known as the event log.
40///
41/// <https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)>
42#[derive(Default, Deserialize, Serialize, Debug, Clone)]
43#[allow(non_snake_case)]
44#[allow(non_camel_case_types)]
45pub struct Win32_NTEventlogFile {
46 /// Bitmask that represents the access rights required to access or perform specific operations
47 /// on the event log file. For bit values, see File and Directory Access Rights Constants.
48 ///
49 /// Note: On FAT volumes, the `FULL_ACCESS` value is returned instead, which indicates no security
50 /// has been set on the object.
51 pub AccessMask: Option<u32>,
52 /// If `True`, a file that contains Windows events should be archived.
53 pub Archive: Option<bool>,
54 /// Short description of the object.
55 pub Caption: Option<String>,
56 /// If `True`, a file that contains Windows events is compressed.
57 pub Compressed: Option<bool>,
58 /// Algorithm or tool used to compress the logical file that contains Windows events.
59 pub CompressionMethod: Option<String>,
60 /// Name of the first concrete class to appear in the inheritance chain used in the creation of an
61 /// instance. When used with the other key properties of the class, this property allows all
62 /// instances of this class and its subclasses to be uniquely identified.
63 pub CreationClassName: Option<String>,
64 /// Date that the file that contains Windows events was created.
65 pub CreationDate: Option<WMIDateTime>,
66 /// Class of the computer system.
67 pub CSCreationClassName: Option<String>,
68 /// Name of the computer system.
69 pub CSName: Option<String>,
70 /// Description of the object.
71 pub Description: Option<String>,
72 /// Drive letter (including colon) of the file that contains Windows events.
73 ///
74 /// Example: "c:"
75 pub Drive: Option<String>,
76 /// DOS-compatible file name for the file that contains Windows events.
77 ///
78 /// Example: "c:\progra~1"
79 pub EightDotThreeFileName: Option<String>,
80 /// File that contains Windows events is encrypted.
81 pub Encrypted: Option<bool>,
82 /// Algorithm or tool used to encrypt the logical file.
83 pub EncryptionMethod: Option<String>,
84 /// File name extension (without the dot) of the file that contains Windows events.
85 ///
86 /// Example: "txt", "mof", "mdb"
87 pub Extension: Option<String>,
88 /// File name (without extension) of the file that contains Windows events.
89 ///
90 /// Example: "autoexec"
91 pub FileName: Option<String>,
92 /// Size of the file that contains Windows events (in bytes).
93 ///
94 /// For more information about using `uint64` values in scripts, see Scripting in WMI.
95 pub FileSize: Option<u64>,
96 /// File type (indicated by the `Extension` property).
97 pub FileType: Option<String>,
98 /// Class of the file system.
99 pub FSCreationClassName: Option<String>,
100 /// Name of the file system.
101 pub FSName: Option<String>,
102 /// If `True`, a file that contains Windows events is hidden.
103 pub Hidden: Option<bool>,
104 /// Object is installed. This property does not need a value to indicate that the object is installed.
105 pub InstallDate: Option<WMIDateTime>,
106 /// Number of "file opens" that are currently active against the file that contains Windows events.
107 ///
108 /// For more information about using `uint64` values in scripts, see Scripting in WMI.
109 pub InUseCount: Option<u64>,
110 /// Date and time that the file that contains Windows events was last accessed.
111 pub LastAccessed: Option<WMIDateTime>,
112 /// Date and time that the file that contains Windows events was last modified.
113 pub LastModified: Option<WMIDateTime>,
114 /// Name of the file that contains Windows events. Standard log file names include: Application,
115 /// System, and Security.
116 ///
117 /// To return the actual path and file name of the event log
118 /// (for example, C:\Windows\System32\Config\Sysevent.evt), use the Name property instead.
119 pub LogfileName: Option<String>,
120 /// Manufacturer from version resource, if one is present.
121 pub Manufacturer: Option<String>,
122 /// Maximum size (in bytes) permitted for the file that contains Windows events. If the file
123 /// exceeds its maximum size, its contents are moved to another file and the primary file is
124 /// emptied. A value of zero indicates no size limit. WMI retrieves the `Maxsize` value from the
125 /// Event Log Service registry values.
126 ///
127 /// Although event logs can be sized as large as 4 gigabytes, in practice they should be limited
128 /// to no more than 300 megabytes. Event logs larger than that can be difficult to analyze because
129 /// of the number of events contained within the log and because event logs are not optimized for
130 /// data retrieval.
131 pub MaxFileSize: Option<u32>,
132 /// Inherited name that serves as a key of a logical file instance that contains Windows events
133 /// within a file system. Full path names should be provided.
134 ///
135 /// Example: "c:\winnt\system\win.ini"
136 pub Name: Option<String>,
137 /// Number of records in the file that contains Windows events. This value is determined by calling
138 /// the Windows function `GetNumberOfEventLogRecords`.
139 pub NumberOfRecords: Option<u32>,
140 /// Number of days after which an event can be overwritten.
141 ///
142 /// Possible values for `OverwriteOutDated` include the following.
143 ///
144 /// Value: Meaning
145 ///
146 /// - 0 (0x0): Any record can be overwritten if necessary. If necessary, all existing events in the event log can be overwritten to make room for new events.
147 /// - 1...365: `Windows Server 2003 and Windows XP`: Possible values for `OverwriteOutDated` include the following. Events older than the specified number of days can be overwritten as needed. If the event log does not contain any records older than the value specified, no new events will be recorded until the log has been cleared.
148 /// - 4294967295 (0xFFFFFFFF): No records can be overwritten. If the log reaches its maximum size, no new events will be recorded until the log has been cleared.
149 pub OverwriteOutDated: Option<u32>,
150 /// Current overwrite policy the Event Log service employs for this log file. Data can be never
151 /// overwritten, or can be overwritten when necessary or when outdated. When data is outdated
152 /// depends on the OverwriteOutDated value.
153 ///
154 /// Value: Meaning
155 ///
156 /// - WhenNeeded: The value of `OverwriteOutDated` equals 0 (zero). Any record can be overwritten to make room for new records.
157 /// - OutDated: The value of `OverwriteOutDated` ranges from 1 to 365. Records older than a specified number of days can be overwritten to make room for new records.
158 /// - Never: The value of `OverwriteOutDated` equals 4294967295. Old records are never overwritten.
159 pub OverWritePolicy: Option<String>,
160 /// Path of the file that contains Windows event. This includes leading and trailing backslashes.
161 ///
162 /// Example: "\windows\system\"
163 pub Path: Option<String>,
164 /// If `True`, a file that contains Windows events can be read.
165 pub Readable: Option<bool>,
166 /// List of applications that are registered to log into this log file.
167 pub Sources: Option<Vec<String>>,
168 /// Current status of the object.
169 ///
170 /// The values are:
171 /// - "OK"
172 /// - "Error"
173 /// - "Degraded"
174 /// - "Unknown"
175 /// - "Pred Fail"
176 /// - "Starting"
177 /// - "Stopping"
178 /// - "Service"
179 /// - "Stressed"
180 /// - "NonRecover"
181 /// - "No Contact"
182 /// - "Lost Comm"
183 pub Status: Option<String>,
184 /// If `True`, a file that contains Windows event is a system file.
185 pub System: Option<bool>,
186 /// Version string from version resource if one is present.
187 pub Version: Option<String>,
188 /// If `True`, a file that contains Windows events can be written.
189 pub Writeable: Option<bool>,
190}
191
192/// The `Win32_NTLogEvent` WMI class is used to translate instances from the Windows event log.
193/// An application must have `SeSecurityPrivilege` to receive events from the security event log,
194/// otherwise "Access Denied" is returned to the application.
195///
196/// <https://learn.microsoft.com/en-us/previous-versions/windows/desktop/eventlogprov/win32-ntlogevent>
197#[derive(Default, Deserialize, Serialize, Debug, Clone)]
198#[allow(non_snake_case)]
199#[allow(non_camel_case_types)]
200pub struct Win32_NTLogEvent {
201 /// Classification of the event as determined by the source. This subcategory is source-specific.
202 ///
203 /// Although primarily used when recording Security events, this property is available in other
204 /// event logs as well. Common Security categories include Logon/Logoff, Account Management, and
205 /// System Event.
206 pub Category: Option<u16>,
207 /// Translation of the subcategory. The translation is source-specific.
208 pub CategoryString: Option<String>,
209 /// Name of the computer that generated this event.
210 pub ComputerName: Option<String>,
211 /// List of the binary data that accompanied the report of the Windows event.
212 pub Data: Option<Vec<u8>>,
213 /// Value of the lower 16-bits of the `EventIdentifier` property. It is present to match the value
214 /// displayed in the Windows Event Viewer.
215 ///
216 /// Note: Two events from the same source may have the same value for this property but may have
217 /// different severity and EventIdentifier values. For example, a successful logoff is recorded in
218 /// the Security log with the Event ID 538. However, Event IDs are not necessarily unique.
219 /// It is possible that, when retrieving Event ID 538, you can get other kinds of events with ID 538.
220 /// If this happens, you might need to filter by the source as well as ID.
221 pub EventCode: Option<u16>,
222 /// Identifier of the event. This is specific to the source that generated the event log entry and
223 /// is used, together with `SourceName`, to uniquely identify a Windows event type.
224 pub EventIdentifier: Option<u32>,
225 /// Type of event.
226 ///
227 /// Value: Meaning
228 ///
229 /// - 1: Error
230 /// - 2: Warning
231 /// - 3: Information
232 /// - 4: Security Audit Success
233 /// - 5: Security Audit Failure
234 pub EventType: Option<u8>,
235 /// List of the insertion strings that accompanied the report of the Windows event.
236 pub InsertionStrings: Option<Vec<String>>,
237 /// Name of Windows event log file. Together with `RecordNumber`, this is used to uniquely identify
238 /// an instance of this class.
239 pub Logfile: Option<String>,
240 /// Event message as it appears in the Windows event log. This is a standard message with zero or more
241 /// insertion strings supplied by the source of the Windows event. The insertion strings are inserted
242 /// into the standard message in a predefined format. If there are no insertion strings or there is a
243 /// problem inserting the insertion strings, only the standard message will be present in this field.
244 pub Message: Option<String>,
245 /// Identifies the event within the Windows event log file. This is specific to the log file and is
246 /// used together with the log file name to uniquely identify an instance of this class.
247 ///
248 /// Record numbers are always unique; they are not reset to 1 when an event log is cleared. As a result,
249 /// the highest record number also indicates the number of records that have been written to the event log
250 /// since the operating system was installed
251 pub RecordNumber: Option<u32>,
252 /// Name of the source (application, service, driver, or subsystem) that generated the entry. It is used,
253 /// together with `EventIdentifier` to uniquely identify a Windows event type.
254 pub SourceName: Option<String>,
255 /// The time when the event is generated.
256 pub TimeGenerated: Option<WMIDateTime>,
257 /// The time when the event is written to the log file.
258 pub TimeWritten: Option<WMIDateTime>,
259 /// Type of event. This is an enumerated string. It is preferable to use the `EventType` property rather than
260 /// the `Type` property.
261 ///
262 /// Value: Meaning
263 ///
264 /// - 1: Error
265 /// - 2: Warning
266 /// - 4: Information
267 /// - 8: Security Audit Success
268 /// - 16: Security Audit Failure
269 pub Type: Option<String>,
270 /// User name of the logged-on user when the event occurred. If the user name cannot be determined,
271 /// this will be `NULL`.
272 pub User: Option<String>,
273}