golang-win32 icon indicating copy to clipboard operation
golang-win32 copied to clipboard

Include ability to filter/query returned events

Open dvas0004 opened this issue 3 years ago • 1 comments

This is useful when you're interested in a subset of events, and it's quite easy to query using XPath. One use case that's quite common is to subscribe to events from a particular Event Record ID onwards. As-is, the library only currently allow you to subscribe to any new events, or to events starting from the oldest record. However, it's quite common to have a scenario similar to "bookmarking":

As we receive an process events, note the event record ID. In case of a disruption or other unforeseen event, load the last processed event record ID and start processing from that record ID onwards (some additional logic is required in case of event record ID rollover). In this scenario, the function call now becomes:

eventProvider := wevtapi.NewPullEventProvider()
xmlEvents := eventProvider.FetchEvents([]string{"Application"}, wevtapi.EvtSubscribeStartAtOldestRecord, "Event[System[EventRecordID > 8000]]")

Note the last (new) argument which is an XPath query.

To revert back to default behavior, simply set the last argument to "*"

dvas0004 avatar Jun 24 '21 14:06 dvas0004

I just realized that since Golang doesnt support optional function arguments or default values, this proposal might break programs which leverage this library....

It might be better to just copy/paste this function and call it something else like FetchEventsWithQuery and leave the current function as-is to preserve backwards compatibility

dvas0004 avatar Jun 24 '21 14:06 dvas0004