github.com/DataDog/datadog-agent/pkg/util/winutil

Windows Event Log package

These package(s) interact with the Windows Event Log API

• evtsubscribe - Implements a Pull Subscription
• evtbookmark - Bookmarking Events

See the example usage.

APIs

The evtapi.API interface includes functions from both the legacy Event Logging API as well as the newer Windows Event Log API.

Testing

The eventlog_test.APITester interface provides helpers for writing tests that need to install/remove event logs/channels, sources, and generate events.

Tests can be run using either the Windows API or the Fake API, selected by the -evtapi argument to go test. By default the tests are run only with the Fake API to avoid inadvertently modifying the host event logs.

Unit tests

Simply run go test ./... to run the tests with the Fake API.

Integration tests

The tests can be run with the Windows API, which will install/remove event logs on the system and fill them with events.

The integration tests can be run directly go test ./... -evtapi Windows, or through the invoke task inv -e integration-tests.