Contents

require 'winevt'
require 'rexml/document'

@query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")

@query.each do |eventlog, message|
  doc = REXML::Document.new(eventlog)
  nodes = []
  REXML::XPath.each(doc, "/Event/EventData/Data") do |node|
    nodes << node.text
  end
  message = message.gsub(/(%\d+)/, '\1$s')
  message = sprintf(message, *nodes)

  puts ({eventlog: eventlog, data: message})
end

Version data entries

14 entries across 14 versions & 1 rubygems

Version	Path
winevt_c-0.3.1-x86-mingw32	example/eventlog.rb
winevt_c-0.3.1-x64-mingw32	example/eventlog.rb
winevt_c-0.3.0-x86-mingw32	example/eventlog.rb
winevt_c-0.3.0-x64-mingw32	example/eventlog.rb
winevt_c-0.2.4-x86-mingw32	example/eventlog.rb
winevt_c-0.2.4-x64-mingw32	example/eventlog.rb
winevt_c-0.2.3-x86-mingw32	example/eventlog.rb
winevt_c-0.2.3-x64-mingw32	example/eventlog.rb
winevt_c-0.2.2-x86-mingw32	example/eventlog.rb
winevt_c-0.2.2-x64-mingw32	example/eventlog.rb
winevt_c-0.2.1-x86-mingw32	example/eventlog.rb
winevt_c-0.2.1-x64-mingw32	example/eventlog.rb
winevt_c-0.2.0-x86-mingw32	example/eventlog.rb
winevt_c-0.2.0-x64-mingw32	example/eventlog.rb