Well-Typed are happy to announce Eventlog Live, a program that streams real-time telemetry from any Haskell application to any observability platform that supports the OpenTelemetry protocol.

is the one-stop shop utility designed to simplify Windows security event log analysis, audit pol...

well-typed.com ### Real-Time Telemetry with Eventlog Live Well-Typed are happy to announce Eventlog Live, a program that streams real-time telemetry from any Haskell application to any observability platform that supports the OpenTelemetry protocol.

> We’re also planning to create a library for writing structured log messages to the eventlog Interesting. Is there an advantage to doing this, vs. the usual logging solutions?

> We’re also planning to create a library for writing structured log messages to the eventlog Interesting. Is there an advantage to doing this, vs. the usual logging solutions?

> We’re also planning to create a library for writing structured log messages to the eventlog Interesting. Is there an advantage to doing this, vs. the usual logging solutions?

This is really exciting stuff! The event log is tragically underutilized.

This is really exciting stuff! The event log is tragically underutilized.

The EventLogs have long been the go-to source for incident investigators in the realm of Windows operating system forensics.

With the current version of Eventlog Live, anything you log using `traceEvent` and `traceEventIO` is converted into a log record with `TRACE` severity, because those functions don’t let you set an explicit severity and, well, it’s right there in the name. My plan is to create a tiny library that uses `traceBinaryEvent` and `traceBinaryEventIO` to write log records with a severity and the other attributes supported by the OTLP specification, which would give you a powerful logging framework in one IO-action (and one not incredibly predictable “pure” function, if you truly need it). The upside is a powerful logging framework that is incredibly lightweight and doesn’t require you to use a monad transformer or pass around a log action. All it does is serialize a log record and write it to the event log. The downside is you lose some of the flexibility that, e.g., libraries such as co-log give you. I’d argue, though, that Eventlog Live gives you a lot of that flexibility back, e.g., it’s perfectly capable of writing your logs to stdout or forwards them to some other application for further exploration.

With the current version of Eventlog Live, anything you log using `traceEvent` and `traceEventIO` is converted into a log record with `TRACE` severity, because those functions don’t let you set an explicit severity and, well, it’s right there in the name. My plan is to create a tiny library that uses `traceBinaryEvent` and `traceBinaryEventIO` to write log records with a severity and the other attributes supported by the OTLP specification, which would give you a powerful logging framework in one IO-action (and one not incredibly predictable “pure” function, if you truly need it). The upside is a powerful logging framework that is incredibly lightweight and doesn’t require you to use a monad transformer or pass around a log action. All it does is serialize a log record and write it to the event log. The downside is you lose some of the flexibility that, e.g., libraries such as co-log give you. I’d argue, though, that Eventlog Live gives you a lot of that flexibility back, e.g., it’s perfectly capable of writing your logs to stdout or forwards them to some other application for further exploration.

With the current version of Eventlog Live, anything you log using `traceEvent` and `traceEventIO` is converted into a log record with `TRACE` severity, because those functions don’t let you set an explicit severity and, well, it’s right there in the name. My plan is to create a tiny library that uses `traceBinaryEvent` and `traceBinaryEventIO` to write log records with a severity and the other attributes supported by the OTLP specification, which would give you a powerful logging framework in one IO-action (and one not incredibly predictable “pure” function, if you truly need it). The upside is a powerful logging framework that is incredibly lightweight and doesn’t require you to use a monad transformer or pass around a log action. All it does is serialize a log record and write it to the event log. The downside is you lose some of the flexibility that, e.g., libraries such as co-log give you. I’d argue, though, that Eventlog Live gives you a lot of that flexibility back, e.g., it’s perfectly capable of writing your logs to stdout or forwards them to some other application for further exploration.

is the one-stop shop utility designed to simplify Windows security event log analysis, audit pol...

is the one-stop shop utility designed to simplify Windows security event log analysis, audit pol...

is the one-stop shop utility designed to simplify Windows security event log analysis, audit pol...

Windows EventLogをバイナリエディタのみで読み進んでいくとてもマニアックな本です。 Windows EventLogはBinXMLと呼ばれるバイナリで表されたXMLが使われます。BinXMLについての解説本です。 Imhexと呼ばれるバイナリエディタを用いて視覚的にわかりやすく説明しています。 Windows EventLogを理解して最強のエンジニアになりましょう！！ 著者：dor...