Function query

salt/modules/win_event.py:428–515

Query a log for a specific event_id. Return the top number of records specified. Use the :py:func:`win_event.get_log_names ` to see a list of available logs on the system. .. Note:: You can use the Windows Event Viewer to create the

(log_name, query_text=None, records=20, latest=True, raw=False)

def query(log_name, query_text=None, records=20, latest=True, raw=False):
    """
    Query a log for a specific event_id. Return the top number of records
    specified. Use the
    :py:func:`win_event.get_log_names <salt.modules.win_event.get_log_names>`
    to see a list of available logs on the system.

    .. Note::
        You can use the Windows Event Viewer to create the XPath query for the
        ``query_text`` parameter. Click on ``Filter Current Log``, configure the
        filter, then click on the XML tab. Copy the text between the two
        ``<Select>`` tags. This will be the contents of the ``query_text``
        parameter. You will have to convert some codes. For example, ``&gt;``
        becomes ``>``, ``&lt;`` becomes ``<``. Additionally, you&#x27;ll need to
        put spaces between comparison operators. For example: ``this >= that``.

    Args:

        log_name (str): The name of the log to query

        query_text (:obj:`str`, optional):
            The filter to apply to the log.
            Default is ``None``.

        records (:obj:`int`, optional):
            The number of records to return.
            Default is 20

        latest (:obj:`bool`, optional):
            ``True`` will return the newest events. ``False`` will return the
            oldest events.
            Default is ``True``.

        raw (:obj:`bool`, optional):
            ``True`` will return the raw xml results. ``False`` will return the
            xml converted to a dictionary.
            Default is ``False``.

    Returns:
        list: A list of dict objects that contain information about the event

    CLI Example:

    .. code-block:: bash

        # Return the 20 most recent events from the Application log with an event ID of 22
        salt '*' win_event.query Application '*[System[(EventID=22)]]'

        # Return the 20 most recent events from the Application log with an event ID of 22
        # Return raw xml
        salt '*' win_event.query Application '*[System[(EventID=22)]]' raw=True

        # Return the 20 oldest events from the Application log with an event ID of 22
        salt '*' win_event.query Application '*[System[(EventID=22)]]' latest=False

        # Return the 20 most recent Critical (1) events from the Application log in the last 12 hours
        salt '*' win_event.query Application '*[System[(Level=1) and TimeCreated[timediff(@SystemTime) <= 43200000]]]'