Java Native Access Platform 5.14.0 · com.sun.jna.platform.win32.WevtapiUtil

Access	Constructor and Description
public	WevtapiUtil()

Method Summary

Modifier and Type	Method and Description
public static String	Returns: Formatted message string EvtFormatMessage(Winevt.EVT_HANDLE [in] A handle to the provider's metadata that the `Wevtapi#EvtOpenPublisherMetadata` function returns. The handle acts as a formatting context for the event or message identifier. You can set this parameter to NULL if the Windows Event Collector service forwarded the event. Forwarded events include a RenderingInfo section that contains the rendered message strings. You can also set this parameter to NULL if the event property that you are formatting is defined in the Winmeta.xml file (for example, if level is set to win:Error). In the latter case, the service uses the Winmeta provider as the formatting context and will format only those message strings that you reference in your event that are defined in the Winmeta.xml file. publisherMetadata, Winevt.EVT_HANDLE [in] A handle to an event. The Flags parameter specifies the message string in the event that you want to format. This parameter must be NULL if the Flags parameter is set to EvtFormatMessageId. event, int [in] The resource identifier of the message string that you want to format. To get the resource identifier for a message string, call the `Wevtapi#EvtGetPublisherMetadataProperty` function. Set this parameter only if the Flags parameter is set to EvtFormatMessageId. messageId, int [in] The number of values in the Values parameter. valueCount, Winevt.EVT_VARIANT[] [in] An array of insertion values to use when formatting the event's message string. Typically, you set this parameter to NULL and the function gets the insertion values from the event data itself. You would use this parameter to override the default behavior and supply the insertion values to use. For example, you might use this parameter if you wanted to resolve a SID to a principal name before inserting the value. To override the insertion values, the Flags parameter must be set to `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageEvent`, `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageXml`, or `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId`, If Flags is set to `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId`, the resource identifier must identify the event's message string. values, int [in] A flag that specifies the message string in the event to format. For possible values, see the `Winevt.EVT_FORMAT_MESSAGE_FLAGS` enumeration. flags) Formats a message string.
public static Winevt.EVT_VARIANT	Returns: EVT_VARIANT(already reading from native memory) EvtGetChannelConfigProperty(Winevt.EVT_HANDLE [in] A handle to the channel's configuration properties that the `Wevtapi#EvtOpenChannelConfig` function returns. channelHandle, int [in] The identifier of the channel property to retrieve. For a list of property identifiers, see the `Winevt.EVT_CHANNEL_CONFIG_PROPERTY_ID` enumeration. propertyId) Gets the specified channel configuration property.
public static String	Returns: error information text EvtGetExtendedStatus() Gets a text message that contains the extended error information for the current error.
public static Memory	Returns: A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object. EvtGetPublisherMetadataProperty(Winevt.EVT_HANDLE [in] A handle to the metadata that the `Wevtapi#EvtOpenPublisherMetadata` function returns. PublisherMetadata, int [in] The identifier of the metadata property to retrieve. For a list of property identifiers, see the `Winevt.EVT_PUBLISHER_METADATA_PROPERTY_ID` enumeration. PropertyId, int [in] Reserved. Must be zero. Flags) Gets the specified provider metadata property.
public static String	Returns: The name of the registered provider. EvtNextPublisherId(Winevt.EVT_HANDLE [in] A handle to the registered providers enumerator that the `Wevtapi#EvtOpenPublisherEnum` function returns. publisherEnum) Gets the identifier of a provider from the enumerator.
public static Memory	Returns: A caller-allocated buffer that will receive the rendered output. The contents is a null-terminated Unicode string if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml` or `Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark`. Otherwise, if Flags is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues`, the buffer contains an array of EVT_VARIANT structures; one for each property specified by the rendering context. The PropertyCount parameter contains the number of elements in the array. the `Kernel32#GetLastError` function. EvtRender(Winevt.EVT_HANDLE [in] A handle to the rendering context that the `Wevtapi#EvtCreateRenderContext` function returns. This parameter must be set to NULL if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml` or `Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark`. context, Winevt.EVT_HANDLE [in] A handle to an event or to a bookmark. Set this parameter to a bookmark handle if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml`; otherwise, set to an event handle. fragment, int [in] A flag that identifies what to render. For example, the entire event or specific properties of the event. For possible values,see the `Winevt.EVT_RENDER_FLAGS` enumeration. flags, IntByReference [out] The number of the properties in the Buffer parameter if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues`; otherwise, zero. propertyCount) Renders an XML fragment based on the rendering context that you specify.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

WevtapiUtil	back to summary
public WevtapiUtil()

Method Detail

EvtFormatMessage back to summary

EvtFormatMessage	back to summary
public static String EvtFormatMessage(Winevt.EVT_HANDLE publisherMetadata, Winevt.EVT_HANDLE event, int messageId, int valueCount, Winevt.EVT_VARIANT[] values, int flags) Formats a message string. Parameters publisherMetadata:Winevt.EVT_HANDLE [in] A handle to the provider's metadata that the `Wevtapi#EvtOpenPublisherMetadata` function returns. The handle acts as a formatting context for the event or message identifier. You can set this parameter to NULL if the Windows Event Collector service forwarded the event. Forwarded events include a RenderingInfo section that contains the rendered message strings. You can also set this parameter to NULL if the event property that you are formatting is defined in the Winmeta.xml file (for example, if level is set to win:Error). In the latter case, the service uses the Winmeta provider as the formatting context and will format only those message strings that you reference in your event that are defined in the Winmeta.xml file. event:Winevt.EVT_HANDLE [in] A handle to an event. The Flags parameter specifies the message string in the event that you want to format. This parameter must be NULL if the Flags parameter is set to EvtFormatMessageId. messageId:int [in] The resource identifier of the message string that you want to format. To get the resource identifier for a message string, call the `Wevtapi#EvtGetPublisherMetadataProperty` function. Set this parameter only if the Flags parameter is set to EvtFormatMessageId. valueCount:int [in] The number of values in the Values parameter. values:Winevt.EVT_VARIANT[] [in] An array of insertion values to use when formatting the event's message string. Typically, you set this parameter to NULL and the function gets the insertion values from the event data itself. You would use this parameter to override the default behavior and supply the insertion values to use. For example, you might use this parameter if you wanted to resolve a SID to a principal name before inserting the value. To override the insertion values, the Flags parameter must be set to `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageEvent`, `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageXml`, or `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId`, If Flags is set to `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId`, the resource identifier must identify the event's message string. flags:int [in] A flag that specifies the message string in the event to format. For possible values, see the `Winevt.EVT_FORMAT_MESSAGE_FLAGS` enumeration. Returns:String Formatted message string

public static String EvtFormatMessage(Winevt.EVT_HANDLE publisherMetadata, Winevt.EVT_HANDLE event, int messageId, int valueCount, Winevt.EVT_VARIANT[] values, int flags)

Formats a message string.

Parameters

publisherMetadata:Winevt.EVT_HANDLE

[in] A handle to the provider's metadata that the Wevtapi#EvtOpenPublisherMetadata function returns. The handle acts as a formatting context for the event or message identifier.

You can set this parameter to NULL if the Windows Event Collector service forwarded the event. Forwarded events include a RenderingInfo section that contains the rendered message strings. You can also set this parameter to NULL if the event property that you are formatting is defined in the Winmeta.xml file (for example, if level is set to win:Error). In the latter case, the service uses the Winmeta provider as the formatting context and will format only those message strings that you reference in your event that are defined in the Winmeta.xml file.

event:Winevt.EVT_HANDLE

[in] A handle to an event. The Flags parameter specifies the message string in the event that you want to format. This parameter must be NULL if the Flags parameter is set to EvtFormatMessageId.

messageId:int

[in] The resource identifier of the message string that you want to format. To get the resource identifier for a message string, call the Wevtapi#EvtGetPublisherMetadataProperty function. Set this parameter only if the Flags parameter is set to EvtFormatMessageId.

valueCount:int

[in] The number of values in the Values parameter.

values:Winevt.EVT_VARIANT[]

[in] An array of insertion values to use when formatting the event's message string. Typically, you set this parameter to NULL and the function gets the insertion values from the event data itself. You would use this parameter to override the default behavior and supply the insertion values to use. For example, you might use this parameter if you wanted to resolve a SID to a principal name before inserting the value.

To override the insertion values, the Flags parameter must be set to Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageEvent, Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageXml, or Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId, If Flags is set to Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId, the resource identifier must identify the event's message string.

flags:int

[in] A flag that specifies the message string in the event to format. For possible values, see the Winevt.EVT_FORMAT_MESSAGE_FLAGS enumeration.

Returns:String

Formatted message string

EvtGetChannelConfigProperty back to summary

EvtGetChannelConfigProperty	back to summary
public static Winevt.EVT_VARIANT EvtGetChannelConfigProperty(Winevt.EVT_HANDLE channelHandle, int propertyId) Gets the specified channel configuration property. Parameters channelHandle:Winevt.EVT_HANDLE [in] A handle to the channel's configuration properties that the `Wevtapi#EvtOpenChannelConfig` function returns. propertyId:int [in] The identifier of the channel property to retrieve. For a list of property identifiers, see the `Winevt.EVT_CHANNEL_CONFIG_PROPERTY_ID` enumeration. Returns:Winevt.EVT_VARIANT EVT_VARIANT(already reading from native memory)

public static Winevt.EVT_VARIANT EvtGetChannelConfigProperty(Winevt.EVT_HANDLE channelHandle, int propertyId)

Gets the specified channel configuration property.

Parameters

channelHandle:Winevt.EVT_HANDLE: [in] A handle to the channel's configuration properties that the Wevtapi#EvtOpenChannelConfig function returns.
propertyId:int: [in] The identifier of the channel property to retrieve. For a list of property identifiers, see the Winevt.EVT_CHANNEL_CONFIG_PROPERTY_ID enumeration.

Returns:Winevt.EVT_VARIANT

EVT_VARIANT(already reading from native memory)

EvtGetExtendedStatus	back to summary
public static String EvtGetExtendedStatus() Gets a text message that contains the extended error information for the current error. Returns:String error information text

EvtGetExtendedStatus

back to summary

public static String EvtGetExtendedStatus()

Gets a text message that contains the extended error information for the current error.

Returns:String: error information text

EvtGetPublisherMetadataProperty back to summary

public static Memory EvtGetPublisherMetadataProperty(Winevt.EVT_HANDLE PublisherMetadata, int PropertyId, int Flags)

Gets the specified provider metadata property.

Parameters

PublisherMetadata:Winevt.EVT_HANDLE: [in] A handle to the metadata that the Wevtapi#EvtOpenPublisherMetadata function returns.
PropertyId:int: [in] The identifier of the metadata property to retrieve. For a list of property identifiers, see the Winevt.EVT_PUBLISHER_METADATA_PROPERTY_ID enumeration.
Flags:int: [in] Reserved. Must be zero.

Returns:Memory

A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object.

EvtNextPublisherId back to summary

EvtNextPublisherId	back to summary
public static String EvtNextPublisherId(Winevt.EVT_HANDLE publisherEnum) Gets the identifier of a provider from the enumerator. Parameters publisherEnum:Winevt.EVT_HANDLE [in] A handle to the registered providers enumerator that the `Wevtapi#EvtOpenPublisherEnum` function returns. Returns:String The name of the registered provider.

public static String EvtNextPublisherId(Winevt.EVT_HANDLE publisherEnum)

Gets the identifier of a provider from the enumerator.

Parameters

publisherEnum:Winevt.EVT_HANDLE: [in] A handle to the registered providers enumerator that the Wevtapi#EvtOpenPublisherEnum function returns.

Returns:String

The name of the registered provider.

EvtRender back to summary

EvtRender	back to summary
public static Memory EvtRender(Winevt.EVT_HANDLE context, Winevt.EVT_HANDLE fragment, int flags, IntByReference propertyCount) Renders an XML fragment based on the rendering context that you specify. Parameters context:Winevt.EVT_HANDLE [in] A handle to the rendering context that the `Wevtapi#EvtCreateRenderContext` function returns. This parameter must be set to NULL if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml` or `Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark`. fragment:Winevt.EVT_HANDLE [in] A handle to an event or to a bookmark. Set this parameter to a bookmark handle if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml`; otherwise, set to an event handle. flags:int [in] A flag that identifies what to render. For example, the entire event or specific properties of the event. For possible values,see the `Winevt.EVT_RENDER_FLAGS` enumeration. propertyCount:IntByReference [out] The number of the properties in the Buffer parameter if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues`; otherwise, zero. Returns:Memory A caller-allocated buffer that will receive the rendered output. The contents is a null-terminated Unicode string if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml` or `Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark`. Otherwise, if Flags is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues`, the buffer contains an array of EVT_VARIANT structures; one for each property specified by the rendering context. The PropertyCount parameter contains the number of elements in the array. the `Kernel32#GetLastError` function.

public static Memory EvtRender(Winevt.EVT_HANDLE context, Winevt.EVT_HANDLE fragment, int flags, IntByReference propertyCount)

Renders an XML fragment based on the rendering context that you specify.

Parameters

context:Winevt.EVT_HANDLE: [in] A handle to the rendering context that the Wevtapi#EvtCreateRenderContext function returns. This parameter must be set to NULL if the Flags parameter is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml or Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark.
fragment:Winevt.EVT_HANDLE: [in] A handle to an event or to a bookmark. Set this parameter to a bookmark handle if the Flags parameter is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml; otherwise, set to an event handle.
flags:int: [in] A flag that identifies what to render. For example, the entire event or specific properties of the event. For possible values,see the Winevt.EVT_RENDER_FLAGS enumeration.
propertyCount:IntByReference: [out] The number of the properties in the Buffer parameter if the Flags parameter is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues; otherwise, zero.

Returns:Memory

A caller-allocated buffer that will receive the rendered output. The contents is a null-terminated Unicode string if the Flags parameter is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml or Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark. Otherwise, if Flags is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues, the buffer contains an array of EVT_VARIANT structures; one for each property specified by the rendering context. The PropertyCount parameter contains the number of elements in the array. the Kernel32#GetLastError function.

public abstract Class WevtapiUtil

Constructor Summary

Method Summary

Constructor Detail

Method Detail