class WinevtXMLDocument

Public Class Methods

new(preserve_qualifiers) click to toggle source
Calls superclass method
# File lib/fluent/plugin/winevt_sax_document.rb, line 4
def initialize(preserve_qualifiers)
  @stack = []
  @result = {}
  @preserve_qualifiers = preserve_qualifiers
  super()
end

Public Instance Methods

MAKELONG(low, high) click to toggle source
# File lib/fluent/plugin/winevt_sax_document.rb, line 11
def MAKELONG(low, high)
  (low & 0xffff) | (high & 0xffff) << 16
end
characters(string) click to toggle source
# File lib/fluent/plugin/winevt_sax_document.rb, line 59
def characters(string)
  element = @stack.last

  if /^EventID|Level|Task|Opcode|Keywords|EventRecordID|
      ActivityID|Channel|Computer|Security|Version$/ === element
    @result[element] = string
  end
end
end_document() click to toggle source
# File lib/fluent/plugin/winevt_sax_document.rb, line 71
def end_document
end
end_element(name, attributes = []) click to toggle source
# File lib/fluent/plugin/winevt_sax_document.rb, line 68
def end_element(name, attributes = [])
end
event_id() click to toggle source
# File lib/fluent/plugin/winevt_sax_document.rb, line 15
def event_id
  if @result.has_key?("Qualifiers")
    qualifiers = @result.delete("Qualifiers")
    event_id = @result['EventID']
    event_id = MAKELONG(event_id.to_i, qualifiers.to_i)
    @result['EventID'] = event_id.to_s
  else
    @result['EventID']
  end
end
result() click to toggle source
# File lib/fluent/plugin/winevt_sax_document.rb, line 26
def result
  return @result if @preserve_qualifiers

  if @result
    @result['EventID'] = event_id
  end
  @result
end
start_document() click to toggle source
# File lib/fluent/plugin/winevt_sax_document.rb, line 35
def start_document
end
start_element(name, attributes = []) click to toggle source
# File lib/fluent/plugin/winevt_sax_document.rb, line 38
def start_element(name, attributes = [])
  @stack << name

  if name == "Provider"
    @result["ProviderName"] = attributes[0][1] rescue nil
    @result["ProviderGUID"] = attributes[1][1] rescue nil
  elsif name == "EventID"
    @result["Qualifiers"] = attributes[0][1] rescue nil
  elsif name == "TimeCreated"
    @result["TimeCreated"] = attributes[0][1] rescue nil
  elsif name == "Correlation"
    @result["ActivityID"] = attributes[0][1] rescue nil
    @result["RelatedActivityID"] = attributes[1][1] rescue nil
  elsif name == "Execution"
    @result["ProcessID"] = attributes[0][1] rescue nil
    @result["ThreadID"] = attributes[1][1] rescue nil
  elsif name == "Security"
    @result["UserID"] = attributes[0][1] rescue nil
  end
end