Function queryWindowsEvents

host/log_windows.go:140–164

(name string, count int)

}

func queryWindowsEvents(name string, count int) ([]windowsEvent, error) {
	if _, err := exec.LookPath("wevtutil"); err != nil {
		return nil, fmt.Errorf("Windows Event Log utility not found")
	}
	if count <= 0 {
		count = 1
	}
	q := fmt.Sprintf(`*[System[Provider[@Name="%s"]]]`, strings.ReplaceAll(name, `"`, `\"`))
	args := []string{
		"qe", "Application",
		"/q:" + q,
		"/f:text",
		"/rd:true",
		fmt.Sprintf("/c:%d", count),
	}
	out, err := exec.Command("wevtutil", args...).CombinedOutput()
	if err != nil {
		msg := strings.TrimSpace(string(out))
		if msg != "" {
			return nil, fmt.Errorf("query windows logs: %s", msg)
		}
		return nil, fmt.Errorf("query windows logs: %w", err)
	}
	return parseWindowsEventText(string(out)), nil
}

func parseWindowsEventText(out string) []windowsEvent {
	var blocks []string