golang-win32
golang-win32 copied to clipboard
Include ability to filter/query returned events
This is useful when you're interested in a subset of events, and it's quite easy to query using XPath. One use case that's quite common is to subscribe to events from a particular Event Record ID onwards. As-is, the library only currently allow you to subscribe to any new events, or to events starting from the oldest record. However, it's quite common to have a scenario similar to "bookmarking":
As we receive an process events, note the event record ID. In case of a disruption or other unforeseen event, load the last processed event record ID and start processing from that record ID onwards (some additional logic is required in case of event record ID rollover). In this scenario, the function call now becomes:
eventProvider := wevtapi.NewPullEventProvider()
xmlEvents := eventProvider.FetchEvents([]string{"Application"}, wevtapi.EvtSubscribeStartAtOldestRecord, "Event[System[EventRecordID > 8000]]")
Note the last (new) argument which is an XPath query.
To revert back to default behavior, simply set the last argument to "*"
I just realized that since Golang doesnt support optional function arguments or default values, this proposal might break programs which leverage this library....
It might be better to just copy/paste this function and call it something else like FetchEventsWithQuery
and leave the current function as-is to preserve backwards compatibility