Documentation
¶
Overview ¶
Package evtbookmark provides helpers for working with Windows Event Log Bookmarks
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Bookmark ¶
type Bookmark interface {
Handle() evtapi.EventBookmarkHandle
Update(evtapi.EventRecordHandle) error
Render() (string, error)
Close()
}
Bookmark is an interface for handling Windows Event Log Bookmarks https://learn.microsoft.com/en-us/windows/win32/wes/bookmarking-events
func FromLatestEvent ¶ added in v0.70.0
FromLatestEvent creates a bookmark pointing to the most recent event matching the channel/query. This prevents the amnesia bug where events between startup and first pull are lost when starting from "now". Returns an empty bookmark if no events exist. An error is only returned if the underlying API calls fail unexpectedly.
The Windows Event Log API (EvtQuery) automatically handles both single-channel queries and multi-channel XML QueryList queries, so no special handling is needed.
Source Files