Documentation
¶
Overview ¶
Package evtbookmark provides helpers for working with Windows Event Log Bookmarks
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrNoMatchingEvents indicates no events matching the query were found ErrNoMatchingEvents = errors.New("no matching events found") )
Functions ¶
This section is empty.
Types ¶
type Bookmark ¶
type Bookmark interface {
Handle() evtapi.EventBookmarkHandle
Update(evtapi.EventRecordHandle) error
Render() (string, error)
Close()
}
Bookmark is an interface for handling Windows Event Log Bookmarks https://learn.microsoft.com/en-us/windows/win32/wes/bookmarking-events
func FromLatestEvent ¶ added in v0.70.0
FromLatestEvent creates a bookmark pointing to the most recent event matching the channel/query. This prevents the amnesia bug where events between startup and first pull are lost when starting from "now". Returns ErrNoMatchingEvents if no events matching the query exist in the log.
The Windows Event Log API (EvtQuery) automatically handles both single-channel queries and multi-channel XML QueryList queries, so no special handling is needed.
type Config ¶ added in v0.73.0
type Config struct {
API evtapi.API
Saver Saver
BookmarkFrequency int // 0 = save every event, >0 = save every N events
}
Config contains configuration for creating a BookmarkManager.
type Manager ¶ added in v0.73.0
type Manager interface {
// UpdateAndSave updates the bookmark with an event and saves according to
// the configured frequency. Use this for normal event processing.
UpdateAndSave(eventHandle evtapi.EventRecordHandle) error
// Save immediately saves the current bookmark, ignoring frequency.
// Use this for periodic checkpoints and before shutdown.
Save() error
// Close cleans up resources including closing the bookmark handle.
Close()
}
Manager handles bookmark persistence with frequency-based saving.
Usage pattern:
- Create manager with NewManager()
- Call UpdateAndSave() as events are processed (respects frequency)
- Call Save() periodically or on shutdown (always saves)
- Call Close() to clean up resources
func NewManager ¶ added in v0.73.0
NewManager creates a new BookmarkManager with the given configuration.
Source Files