admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
288e87a0d366c8cd1604d3987747d31e69bcb320
hakril-PythonForWindows/docs/build/html/evtlog.html
T
hakril 2454bf815b Regenerate sphinx doc
2018-08-03 10:10:31 +02:00

708 lines
47 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>2.14. Event Log &#8212; PythonForWindows 0.4 documentation</title>
<link rel="stylesheet" href="_static/classic.css" type="text/css" />
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="_static/css/mbasic.css" type="text/css" />
<script type="text/javascript" id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
<script type="text/javascript" src="_static/jquery.js"></script>
<script type="text/javascript" src="_static/underscore.js"></script>
<script type="text/javascript" src="_static/doctools.js"></script>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="3. windows.native_exec – Native Code Execution" href="native_exec.html" />
<link rel="prev" title="2.13. Task scheduler" href="task_scheduler.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="native_exec.html" title="3. windows.native_exec – Native Code Execution"
accesskey="N">next</a> |</li>
<li class="right" >
<a href="task_scheduler.html" title="2.13. Task scheduler"
accesskey="P">previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.4 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="winobject.html" accesskey="U">2. The <code class="docutils literal notranslate"><span class="pre">windows</span></code> objects</a> &#187;</li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<div class="section" id="module-windows.winobject.event_log">
<span id="event-log"></span><h1>2.14. Event Log<a class="headerlink" href="#module-windows.winobject.event_log" title="Permalink to this headline"></a></h1>
<p>Some part of the Event Log WINAPI are not straightforward.</p>
<p>I have tried to offer some abstraction without completly hidding the some underlying subtilities (for now).</p>
<p>The current API may need some works to provide simpler/highter level API in the future.</p>
<p>For now, the best thing to do is look at the sample:</p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">See sample <a class="reference internal" href="sample.html#sample-event-log"><span class="std std-ref">Event Log</span></a></p>
</div>
<div class="admonition warning">
<p class="first admonition-title">Warning</p>
<p class="last">This API have not been tested on real case yet and may be subject to changes.</p>
</div>
<div class="section" id="evtlogmanager">
<h2>2.14.1. EvtlogManager<a class="headerlink" href="#evtlogmanager" title="Permalink to this headline"></a></h2>
<dl class="class">
<dt id="windows.winobject.event_log.EvtlogManager">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">EvtlogManager</code><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtlogManager"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtlogManager" title="Permalink to this definition"></a></dt>
<dd><p>The main Evt class to open Evt channel/publisher and evtx file</p>
<dl class="method">
<dt id="windows.winobject.event_log.EvtlogManager.__getitem__">
<code class="descname">__getitem__</code><span class="sig-paren">(</span><em>name</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtlogManager.__getitem__"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtlogManager.__getitem__" title="Permalink to this definition"></a></dt>
<dd><p>Open the Evt Channel/Publisher or Evtx file with <code class="docutils literal notranslate"><span class="pre">name</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EvtChannel" title="windows.winobject.event_log.EvtChannel"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtChannel</span></code></a> or <a class="reference internal" href="#windows.winobject.event_log.EvtPublisher" title="windows.winobject.event_log.EvtPublisher"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtPublisher</span></code></a> or <a class="reference internal" href="#windows.winobject.event_log.EvtFile" title="windows.winobject.event_log.EvtFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtFile</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtlogManager.is_implemented">
<code class="descname">is_implemented</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtlogManager.is_implemented"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtlogManager.is_implemented" title="Permalink to this definition"></a></dt>
<dd><p>Return <code class="docutils literal notranslate"><span class="pre">True</span></code> if the new Evt-API is implemented on the current computer</p>
<p>see: <a class="reference external" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa385784(v=vs.85).aspx">https://msdn.microsoft.com/en-us/library/windows/desktop/aa385784(v=vs.85).aspx</a></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtlogManager.open_channel">
<code class="descname">open_channel</code><span class="sig-paren">(</span><em>name</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtlogManager.open_channel"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtlogManager.open_channel" title="Permalink to this definition"></a></dt>
<dd><p>Open the Evt channel with <code class="docutils literal notranslate"><span class="pre">name</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EvtChannel" title="windows.winobject.event_log.EvtChannel"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtChannel</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtlogManager.open_evtx_file">
<code class="descname">open_evtx_file</code><span class="sig-paren">(</span><em>filename</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtlogManager.open_evtx_file"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtlogManager.open_evtx_file" title="Permalink to this definition"></a></dt>
<dd><p>Open the evtx file with <code class="docutils literal notranslate"><span class="pre">filename</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EvtFile" title="windows.winobject.event_log.EvtFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtFile</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtlogManager.open_publisher">
<code class="descname">open_publisher</code><span class="sig-paren">(</span><em>name</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtlogManager.open_publisher"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtlogManager.open_publisher" title="Permalink to this definition"></a></dt>
<dd><p>Open the Evt publisher with <code class="docutils literal notranslate"><span class="pre">name</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EvtPublisher" title="windows.winobject.event_log.EvtPublisher"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtPublisher</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="channel">
<h2>2.14.2. Channel<a class="headerlink" href="#channel" title="Permalink to this headline"></a></h2>
<div class="section" id="evtchannel">
<h3>2.14.2.1. EvtChannel<a class="headerlink" href="#evtchannel" title="Permalink to this headline"></a></h3>
<dl class="class">
<dt id="windows.winobject.event_log.EvtChannel">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">EvtChannel</code><span class="sig-paren">(</span><em>name</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtChannel"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtChannel" title="Permalink to this definition"></a></dt>
<dd><p>An Event Log channel</p>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtChannel.config">
<code class="descname">config</code><a class="headerlink" href="#windows.winobject.event_log.EvtChannel.config" title="Permalink to this definition"></a></dt>
<dd><p>The configuration of the channel</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.ChannelConfig" title="windows.winobject.event_log.ChannelConfig"><code class="xref py py-class docutils literal notranslate"><span class="pre">ChannelConfig</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtChannel.events">
<code class="descname">events</code><a class="headerlink" href="#windows.winobject.event_log.EvtChannel.events" title="Permalink to this definition"></a></dt>
<dd><p>The list of all events in the channels, an alias for <code class="docutils literal notranslate"><span class="pre">channel.query().all()</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body">[<a class="reference internal" href="#windows.winobject.event_log.EvtEvent" title="windows.winobject.event_log.EvtEvent"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtEvent</span></code></a>] – A list of <a class="reference internal" href="#windows.winobject.event_log.EvtEvent" title="windows.winobject.event_log.EvtEvent"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtEvent</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtChannel.get_event_metadata">
<code class="descname">get_event_metadata</code><span class="sig-paren">(</span><em>id</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtChannel.get_event_metadata"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtChannel.get_event_metadata" title="Permalink to this definition"></a></dt>
<dd><p>Return the metadata for the event ID <code class="docutils literal notranslate"><span class="pre">id</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EventMetadata" title="windows.winobject.event_log.EventMetadata"><code class="xref py py-class docutils literal notranslate"><span class="pre">EventMetadata</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtChannel.query">
<code class="descname">query</code><span class="sig-paren">(</span><em>filter=None</em>, <em>ids=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtChannel.query"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtChannel.query" title="Permalink to this definition"></a></dt>
<dd><p>Query the event with the <code class="docutils literal notranslate"><span class="pre">ids</span></code> or perform a query with the raw query <code class="docutils literal notranslate"><span class="pre">filter</span></code></p>
<p>Both parameters are mutually exclusive.</p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p>Here are some query examples</p>
<dl class="last docutils">
<dt>List all events with a event data attribute named ‘RuleName’:</dt>
<dd><code class="docutils literal notranslate"><span class="pre">Event/EventData/Data[&#64;Name='RuleName']</span></code></dd>
<dt>List all events with a event data value of ‘C:\WINDOWS\System32\svchost.exe’:</dt>
<dd><code class="docutils literal notranslate"><span class="pre">Event/EventData[Data='C:\WINDOWS\System32\svchost.exe']</span></code></dd>
<dt>List all events with an EventID of 2006:</dt>
<dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=2006]</span></code></dd>
</dl>
</div>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EvtQuery" title="windows.winobject.event_log.EvtQuery"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtQuery</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="channelconfig">
<h3>2.14.2.2. ChannelConfig<a class="headerlink" href="#channelconfig" title="Permalink to this headline"></a></h3>
<dl class="class">
<dt id="windows.winobject.event_log.ChannelConfig">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">ChannelConfig</code><span class="sig-paren">(</span><em>handle</em>, <em>name=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#ChannelConfig"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.ChannelConfig" title="Permalink to this definition"></a></dt>
<dd><p>The configuration of a event channel</p>
<dl class="attribute">
<dt id="windows.winobject.event_log.ChannelConfig.classic">
<code class="descname">classic</code><a class="headerlink" href="#windows.winobject.event_log.ChannelConfig.classic" title="Permalink to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the channel is a classic event channel (for example the Application or System log)</p>
</dd></dl>
<dl class="classmethod">
<dt id="windows.winobject.event_log.ChannelConfig.from_channel_name">
<em class="property">classmethod </em><code class="descname">from_channel_name</code><span class="sig-paren">(</span><em>name</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#ChannelConfig.from_channel_name"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.ChannelConfig.from_channel_name" title="Permalink to this definition"></a></dt>
<dd><p>Return the <a class="reference internal" href="#windows.winobject.event_log.ChannelConfig" title="windows.winobject.event_log.ChannelConfig"><code class="xref py py-class docutils literal notranslate"><span class="pre">ChannelConfig</span></code></a> for the channel <code class="docutils literal notranslate"><span class="pre">name</span></code></p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.ChannelConfig.publisher">
<code class="descname">publisher</code><a class="headerlink" href="#windows.winobject.event_log.ChannelConfig.publisher" title="Permalink to this definition"></a></dt>
<dd><p>The <a class="reference internal" href="#windows.winobject.event_log.EvtPublisher" title="windows.winobject.event_log.EvtPublisher"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtPublisher</span></code></a> for the channel</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.ChannelConfig.value">
<code class="descname">value</code><a class="headerlink" href="#windows.winobject.event_log.ChannelConfig.value" title="Permalink to this definition"></a></dt>
<dd><p>current value</p>
</dd></dl>
</dd></dl>
</div>
</div>
<div class="section" id="publisher">
<h2>2.14.3. Publisher<a class="headerlink" href="#publisher" title="Permalink to this headline"></a></h2>
<div class="section" id="evtpublisher">
<h3>2.14.3.1. EvtPublisher<a class="headerlink" href="#evtpublisher" title="Permalink to this headline"></a></h3>
<dl class="class">
<dt id="windows.winobject.event_log.EvtPublisher">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">EvtPublisher</code><span class="sig-paren">(</span><em>name</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtPublisher"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtPublisher" title="Permalink to this definition"></a></dt>
<dd><p>An Event provider</p>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtPublisher.metadata">
<code class="descname">metadata</code><a class="headerlink" href="#windows.winobject.event_log.EvtPublisher.metadata" title="Permalink to this definition"></a></dt>
<dd><p>Return the metadata for this publisher</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.PublisherMetadata" title="windows.winobject.event_log.PublisherMetadata"><code class="xref py py-class docutils literal notranslate"><span class="pre">PublisherMetadata</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="publishermetadata">
<h3>2.14.3.2. PublisherMetadata<a class="headerlink" href="#publishermetadata" title="Permalink to this headline"></a></h3>
<dl class="class">
<dt id="windows.winobject.event_log.PublisherMetadata">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">PublisherMetadata</code><span class="sig-paren">(</span><em>handle</em>, <em>name=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#PublisherMetadata"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.PublisherMetadata" title="Permalink to this definition"></a></dt>
<dd><p>The metadata about an event provider</p>
<dl class="attribute">
<dt id="windows.winobject.event_log.PublisherMetadata.channel_name_by_id">
<code class="descname">channel_name_by_id</code><a class="headerlink" href="#windows.winobject.event_log.PublisherMetadata.channel_name_by_id" title="Permalink to this definition"></a></dt>
<dd><p>The dict of channel defined by this provider by their id</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/stdtypes.html#dict" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">dict</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.PublisherMetadata.channels">
<code class="descname">channels</code><a class="headerlink" href="#windows.winobject.event_log.PublisherMetadata.channels" title="Permalink to this definition"></a></dt>
<dd><p>The list of <a class="reference internal" href="#windows.winobject.event_log.EvtChannel" title="windows.winobject.event_log.EvtChannel"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtChannel</span></code></a> defined by this provider</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body">[<a class="reference internal" href="#windows.winobject.event_log.EvtChannel" title="windows.winobject.event_log.EvtChannel"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtChannel</span></code></a>] – A list of <a class="reference internal" href="#windows.winobject.event_log.EvtChannel" title="windows.winobject.event_log.EvtChannel"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtChannel</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.PublisherMetadata.chanrefs">
<code class="descname">chanrefs</code><a class="headerlink" href="#windows.winobject.event_log.PublisherMetadata.chanrefs" title="Permalink to this definition"></a></dt>
<dd><p>Identifies the channels child element of the provider.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.PropertyArray" title="windows.winobject.event_log.PropertyArray"><code class="xref py py-class docutils literal notranslate"><span class="pre">PropertyArray</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.PublisherMetadata.events_metadata">
<code class="descname">events_metadata</code><a class="headerlink" href="#windows.winobject.event_log.PublisherMetadata.events_metadata" title="Permalink to this definition"></a></dt>
<dd><p>The <a class="reference internal" href="#windows.winobject.event_log.EventMetadata" title="windows.winobject.event_log.EventMetadata"><code class="xref py py-class docutils literal notranslate"><span class="pre">EventMetadata</span></code></a> for each event this provider defines</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Yield:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EventMetadata" title="windows.winobject.event_log.EventMetadata"><code class="xref py py-class docutils literal notranslate"><span class="pre">EventMetadata</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="classmethod">
<dt id="windows.winobject.event_log.PublisherMetadata.from_publisher_name">
<em class="property">classmethod </em><code class="descname">from_publisher_name</code><span class="sig-paren">(</span><em>name</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#PublisherMetadata.from_publisher_name"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.PublisherMetadata.from_publisher_name" title="Permalink to this definition"></a></dt>
<dd><p>The <a class="reference internal" href="#windows.winobject.event_log.PublisherMetadata" title="windows.winobject.event_log.PublisherMetadata"><code class="xref py py-class docutils literal notranslate"><span class="pre">PublisherMetadata</span></code></a> for the publisher <code class="docutils literal notranslate"><span class="pre">name</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.PublisherMetadata.message">
<code class="descname">message</code><span class="sig-paren">(</span><em>msgid</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#PublisherMetadata.message"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.PublisherMetadata.message" title="Permalink to this definition"></a></dt>
<dd><p>TODO</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.PublisherMetadata.value">
<code class="descname">value</code><a class="headerlink" href="#windows.winobject.event_log.PublisherMetadata.value" title="Permalink to this definition"></a></dt>
<dd><p>current value</p>
</dd></dl>
</dd></dl>
</div>
</div>
<div class="section" id="evtfile">
<h2>2.14.4. EvtFile<a class="headerlink" href="#evtfile" title="Permalink to this headline"></a></h2>
<dl class="class">
<dt id="windows.winobject.event_log.EvtFile">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">EvtFile</code><span class="sig-paren">(</span><em>name</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtFile"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtFile" title="Permalink to this definition"></a></dt>
<dd><p>Represent an Evtx file</p>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtFile.config">
<code class="descname">config</code><a class="headerlink" href="#windows.winobject.event_log.EvtFile.config" title="Permalink to this definition"></a></dt>
<dd><p>Not implemented for EvtFile</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Raise:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">NotImplementedError</span></code></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtFile.events">
<code class="descname">events</code><a class="headerlink" href="#windows.winobject.event_log.EvtFile.events" title="Permalink to this definition"></a></dt>
<dd><p>The list of all events in the channels, an alias for <code class="docutils literal notranslate"><span class="pre">channel.query().all()</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body">[<a class="reference internal" href="#windows.winobject.event_log.EvtEvent" title="windows.winobject.event_log.EvtEvent"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtEvent</span></code></a>] – A list of <a class="reference internal" href="#windows.winobject.event_log.EvtEvent" title="windows.winobject.event_log.EvtEvent"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtEvent</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtFile.get_event_metadata">
<code class="descname">get_event_metadata</code><span class="sig-paren">(</span><em>id</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.event_log.EvtFile.get_event_metadata" title="Permalink to this definition"></a></dt>
<dd><p>Return the metadata for the event ID <code class="docutils literal notranslate"><span class="pre">id</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EventMetadata" title="windows.winobject.event_log.EventMetadata"><code class="xref py py-class docutils literal notranslate"><span class="pre">EventMetadata</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtFile.query">
<code class="descname">query</code><span class="sig-paren">(</span><em>filter=None</em>, <em>ids=None</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.event_log.EvtFile.query" title="Permalink to this definition"></a></dt>
<dd><p>Query the event with the <code class="docutils literal notranslate"><span class="pre">ids</span></code> or perform a query with the raw query <code class="docutils literal notranslate"><span class="pre">filter</span></code></p>
<p>Both parameters are mutually exclusive.</p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p>Here are some query examples</p>
<dl class="last docutils">
<dt>List all events with a event data attribute named ‘RuleName’:</dt>
<dd><code class="docutils literal notranslate"><span class="pre">Event/EventData/Data[&#64;Name='RuleName']</span></code></dd>
<dt>List all events with a event data value of ‘C:\WINDOWS\System32\svchost.exe’:</dt>
<dd><code class="docutils literal notranslate"><span class="pre">Event/EventData[Data='C:\WINDOWS\System32\svchost.exe']</span></code></dd>
<dt>List all events with an EventID of 2006:</dt>
<dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=2006]</span></code></dd>
</dl>
</div>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EvtQuery" title="windows.winobject.event_log.EvtQuery"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtQuery</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="event">
<h2>2.14.5. Event<a class="headerlink" href="#event" title="Permalink to this headline"></a></h2>
<div class="section" id="evtevent">
<h3>2.14.5.1. EvtEvent<a class="headerlink" href="#evtevent" title="Permalink to this headline"></a></h3>
<dl class="class">
<dt id="windows.winobject.event_log.EvtEvent">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">EvtEvent</code><span class="sig-paren">(</span><em>handle=0</em>, <em>channel=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtEvent"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtEvent" title="Permalink to this definition"></a></dt>
<dd><p>An Event log</p>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtEvent.data">
<code class="descname">data</code><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.data" title="Permalink to this definition"></a></dt>
<dd><p>A dict of EventData Name:Value for the current dict.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/stdtypes.html#dict" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">dict</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtEvent.id">
<code class="descname">id</code><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.id" title="Permalink to this definition"></a></dt>
<dd><p>The ID of the Event</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtEvent.level">
<code class="descname">level</code><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.level" title="Permalink to this definition"></a></dt>
<dd><p>The level of the Event</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtEvent.metadata">
<code class="descname">metadata</code><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.metadata" title="Permalink to this definition"></a></dt>
<dd><p>The medata for the current Event</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.event_log.EventMetadata" title="windows.winobject.event_log.EventMetadata"><code class="xref py py-class docutils literal notranslate"><span class="pre">EventMetadata</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtEvent.opcode">
<code class="descname">opcode</code><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.opcode" title="Permalink to this definition"></a></dt>
<dd><p>The opcode of the Event</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtEvent.pid">
<code class="descname">pid</code><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.pid" title="Permalink to this definition"></a></dt>
<dd><p>The process ID of the Event</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtEvent.tid">
<code class="descname">tid</code><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.tid" title="Permalink to this definition"></a></dt>
<dd><p>The process ID of the Event</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtEvent.time_created">
<code class="descname">time_created</code><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.time_created" title="Permalink to this definition"></a></dt>
<dd><p>The creation time of the Event</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtEvent.value">
<code class="descname">value</code><span class="sig-paren">(</span><em>name</em>, <em>**kwargs</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtEvent.value"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.value" title="Permalink to this definition"></a></dt>
<dd><p>Retrieve a value from the event.
<code class="docutils literal notranslate"><span class="pre">name</span></code> is an XPath expressions that uniquely identify a node or attribute in the event.
(see <a class="reference external" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa385352(v=vs.85).aspx">https://msdn.microsoft.com/en-us/library/windows/desktop/aa385352(v=vs.85).aspx</a>)</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtEvent.version">
<code class="descname">version</code><a class="headerlink" href="#windows.winobject.event_log.EvtEvent.version" title="Permalink to this definition"></a></dt>
<dd><p>The version of the Event</p>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="eventmetadata">
<h3>2.14.5.2. EventMetadata<a class="headerlink" href="#eventmetadata" title="Permalink to this headline"></a></h3>
<dl class="class">
<dt id="windows.winobject.event_log.EventMetadata">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">EventMetadata</code><a class="reference internal" href="_modules/windows/winobject/event_log.html#EventMetadata"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EventMetadata" title="Permalink to this definition"></a></dt>
<dd><p>The Metadata about a given Event type</p>
<p>see: <a class="reference external" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa385517(v=vs.85).aspx">https://msdn.microsoft.com/en-us/library/windows/desktop/aa385517(v=vs.85).aspx</a></p>
<dl class="attribute">
<dt id="windows.winobject.event_log.EventMetadata.channel_id">
<code class="descname">channel_id</code><a class="headerlink" href="#windows.winobject.event_log.EventMetadata.channel_id" title="Permalink to this definition"></a></dt>
<dd><p>The the Channel attribute of the Event definition</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EventMetadata.event_data">
<code class="descname">event_data</code><a class="headerlink" href="#windows.winobject.event_log.EventMetadata.event_data" title="Permalink to this definition"></a></dt>
<dd><p>The list of attribute specifique for this event.
Retrieved by parsing <a class="reference internal" href="#windows.winobject.event_log.EventMetadata.template" title="windows.winobject.event_log.EventMetadata.template"><code class="xref py py-data docutils literal notranslate"><span class="pre">EventMetadata.template</span></code></a></p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EventMetadata.id">
<code class="descname">id</code><a class="headerlink" href="#windows.winobject.event_log.EventMetadata.id" title="Permalink to this definition"></a></dt>
<dd><p>The ID of the Event</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EventMetadata.message_id">
<code class="descname">message_id</code><a class="headerlink" href="#windows.winobject.event_log.EventMetadata.message_id" title="Permalink to this definition"></a></dt>
<dd><p>Identifies the message attribute of the event definition.</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EventMetadata.template">
<code class="descname">template</code><a class="headerlink" href="#windows.winobject.event_log.EventMetadata.template" title="Permalink to this definition"></a></dt>
<dd><p>Identifies the template attribute of the event definition which is an XML string</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EventMetadata.value">
<code class="descname">value</code><a class="headerlink" href="#windows.winobject.event_log.EventMetadata.value" title="Permalink to this definition"></a></dt>
<dd><p>current value</p>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="evtquery">
<h3>2.14.5.3. EvtQuery<a class="headerlink" href="#evtquery" title="Permalink to this headline"></a></h3>
<dl class="class">
<dt id="windows.winobject.event_log.EvtQuery">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">EvtQuery</code><span class="sig-paren">(</span><em>handle=0</em>, <em>channel=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtQuery"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtQuery" title="Permalink to this definition"></a></dt>
<dd><p>Represent an Event-log query</p>
<dl class="method">
<dt id="windows.winobject.event_log.EvtQuery.all">
<code class="descname">all</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_log.html#EvtQuery.all"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.EvtQuery.all" title="Permalink to this definition"></a></dt>
<dd><p>Return a list with all the query results</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body">[<a class="reference internal" href="#windows.winobject.event_log.EvtEvent" title="windows.winobject.event_log.EvtEvent"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtEvent</span></code></a>] – A list of Event</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.event_log.EvtQuery.next">
<code class="descname">next</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.event_log.EvtQuery.next" title="Permalink to this definition"></a></dt>
<dd><p>Return the next <a class="reference internal" href="#windows.winobject.event_log.EvtEvent" title="windows.winobject.event_log.EvtEvent"><code class="xref py py-class docutils literal notranslate"><span class="pre">EvtEvent</span></code></a> matching the query</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.event_log.EvtQuery.value">
<code class="descname">value</code><a class="headerlink" href="#windows.winobject.event_log.EvtQuery.value" title="Permalink to this definition"></a></dt>
<dd><p>current value</p>
</dd></dl>
</dd></dl>
</div>
</div>
<div class="section" id="todo">
<h2>2.14.6. TODO<a class="headerlink" href="#todo" title="Permalink to this headline"></a></h2>
<dl class="class">
<dt id="windows.winobject.event_log.PropertyArray">
<em class="property">class </em><code class="descclassname">windows.winobject.event_log.</code><code class="descname">PropertyArray</code><a class="reference internal" href="_modules/windows/winobject/event_log.html#PropertyArray"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_log.PropertyArray" title="Permalink to this definition"></a></dt>
<dd><p>TODO</p>
<dl class="attribute">
<dt id="windows.winobject.event_log.PropertyArray.value">
<code class="descname">value</code><a class="headerlink" href="#windows.winobject.event_log.PropertyArray.value" title="Permalink to this definition"></a></dt>
<dd><p>current value</p>
</dd></dl>
</dd></dl>
</div>
</div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<h3><a href="index.html">Table Of Contents</a></h3>
<ul>
<li><a class="reference internal" href="#">2.14. Event Log</a><ul>
<li><a class="reference internal" href="#evtlogmanager">2.14.1. EvtlogManager</a></li>
<li><a class="reference internal" href="#channel">2.14.2. Channel</a><ul>
<li><a class="reference internal" href="#evtchannel">2.14.2.1. EvtChannel</a></li>
<li><a class="reference internal" href="#channelconfig">2.14.2.2. ChannelConfig</a></li>
</ul>
</li>
<li><a class="reference internal" href="#publisher">2.14.3. Publisher</a><ul>
<li><a class="reference internal" href="#evtpublisher">2.14.3.1. EvtPublisher</a></li>
<li><a class="reference internal" href="#publishermetadata">2.14.3.2. PublisherMetadata</a></li>
</ul>
</li>
<li><a class="reference internal" href="#evtfile">2.14.4. EvtFile</a></li>
<li><a class="reference internal" href="#event">2.14.5. Event</a><ul>
<li><a class="reference internal" href="#evtevent">2.14.5.1. EvtEvent</a></li>
<li><a class="reference internal" href="#eventmetadata">2.14.5.2. EventMetadata</a></li>
<li><a class="reference internal" href="#evtquery">2.14.5.3. EvtQuery</a></li>
</ul>
</li>
<li><a class="reference internal" href="#todo">2.14.6. TODO</a></li>
</ul>
</li>
</ul>
<h4>Previous topic</h4>
<p class="topless"><a href="task_scheduler.html"
title="previous chapter">2.13. Task scheduler</a></p>
<h4>Next topic</h4>
<p class="topless"><a href="native_exec.html"
title="next chapter">3. <code class="docutils literal notranslate"><span class="pre">windows.native_exec</span></code> – Native Code Execution</a></p>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="_sources/evtlog.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
<div id="searchbox" style="display: none" role="search">
<h3>Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="search.html" method="get">
<input type="text" name="q" />
<input type="submit" value="Go" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="native_exec.html" title="3. windows.native_exec – Native Code Execution"
>next</a> |</li>
<li class="right" >
<a href="task_scheduler.html" title="2.13. Task scheduler"
>previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.4 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="winobject.html" >2. The <code class="docutils literal notranslate"><span class="pre">windows</span></code> objects</a> &#187;</li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015, Clement Rouault.
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.7.5.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink