Add doc/sample/test for event log code

docs/source/evtlog.rst

@@ -0,0 +1,92 @@
+Event Log
+=========
+
+.. module:: windows.winobject.event_log
+
+
+Some part of the Event Log WINAPI are not straightforward.
+
+I have tried to offer some abstraction without completly hidding the some underlying subtilities (for now).
+
+The current API may need some works to provide simpler/highter level API in the future.
+
+For now, the best thing to do is look at the sample:
+
+.. note::
+
+    See sample :ref:`sample_event_log`
+
+.. warning::
+
+    This API have not been tested on real case yet and may be subject to changes.
+
+
+EvtlogManager
+"""""""""""""
+
+.. autoclass:: EvtlogManager
+    :special-members: __getitem__
+
+
+Channel
+"""""""
+
+EvtChannel
+''''''''''
+
+.. autoclass:: EvtChannel
+
+ChannelConfig
+'''''''''''''
+
+.. autoclass:: ChannelConfig
+
+
+Publisher
+"""""""""
+
+EvtPublisher
+''''''''''''
+
+.. autoclass:: EvtPublisher
+
+PublisherMetadata
+'''''''''''''''''
+
+.. autoclass:: PublisherMetadata
+
+
+EvtFile
+"""""""
+
+.. autoclass:: EvtFile
+
+
+Event
+"""""
+
+EvtEvent
+''''''''
+
+.. autoclass:: EvtEvent
+
+EventMetadata
+'''''''''''''
+
+.. autoclass:: EventMetadata
+
+
+EvtQuery
+''''''''
+
+.. autoclass:: EvtQuery
+
+
+
+TODO
+""""
+
+.. autoclass:: PropertyArray
+
+
+

docs/source/samples_output/event_log_eventlog.txt

@@ -0,0 +1,55 @@
+(cmd) python event_log\eventlog.py
+Event log Manager is: <windows.winobject.event_log.EvtlogManager object at 0x0592DB70>
+They are <1155> channels
+They are <1179> publishers
+Openning channel <Microsoft-Windows-Windows Firewall With Advanced Security/Firewall>
+Channel is <EvtChannel "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall">
+The channel contains <1037> events
+
+Querying "Event/EventData[Data='C:\WINDOWS\System32\svchost.exe'] and Event/System[EventID=2006]">
+Query is <EvtQuery object at 0x06E9F440>
+List contains 304 event
+
+First event is <EvtEvent id="2006" time="2018-05-06 08:03:06.210109">
+System values:
+ * ID: 2006
+ * version: 0
+ * level: 4
+ * opcode: 0
+ * time_created: 131700673862101088
+ * ID: 2006
+Event specific values:
+ * <ModifyingUser> -> <108703760>
+ * <RuleName> -> <ByteCodeGeneration>
+ * <ModifyingApplication> -> <C:\WINDOWS\System32\svchost.exe>
+ * <RuleId> -> <{318EF1CF-A3FA-4B04-8AAC-712276661117}>
+
+Event metadata is <EventMetadata object at 0x06EB96C0>
+ * id : 2006
+ * channel_id : 16
+ * message_id : 2986346454
+ * event_data : [u'RuleId', u'RuleName', u'ModifyingUser', u'ModifyingApplication']
+ * EventData template :
+<template xmlns="http://schemas.microsoft.com/win/2004/08/events">
+  <data name="RuleId" inType="win:UnicodeString" outType="xs:string"/>
+  <data name="RuleName" inType="win:UnicodeString" outType="xs:string"/>
+  <data name="ModifyingUser" inType="win:SID" outType="xs:string"/>
+  <data name="ModifyingApplication" inType="win:UnicodeString" outType="xs:string"/>
+</template>
+
+
+Exploring complex Evt types:
+Channel is still <EvtChannel "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall">
+Channel config is <ChannelConfig "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall">
+Channel publisher is <EvtPublisher "Microsoft-Windows-Windows Firewall With Advanced Security">
+Channel publisher metadata is <PublisherMetadata "Microsoft-Windows-Windows Firewall With Advanced Security">
+Publisher's channels are:
+ * <EvtChannel "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall">
+ * <EvtChannel "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity">
+ * <EvtChannel "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose">
+ * <EvtChannel "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose">
+ * <EvtChannel "Network Isolation Operational">
+Some publisher's event metadata are:
+ * <EventMetadata object at 0x06EBE710>: id=2000
+ * <EventMetadata object at 0x06EBE7B0>: id=2001
+ * <EventMetadata object at 0x06EBE3F0>: id=2002