## Demonstrates a "push" subscription with a callback function
import win32evtlog
query_text='*[System[Provider[@Name="Microsoft-Windows-Winlogon"]]]'

def c(reason, context, evt):
	if reason==win32evtlog.EvtSubscribeActionError:
		print ('EvtSubscribeActionError')
	elif reason==win32evtlog.EvtSubscribeActionDeliver:
		print ('EvtSubscribeActionDeliver')
	else:
		print(('??? Unknown action ???', reason))
	context.append(win32evtlog.EvtRender(evt, win32evtlog.EvtRenderEventXml))
	return 0

evttext=[]
s=win32evtlog.EvtSubscribe('System', win32evtlog.EvtSubscribeStartAtOldestRecord, Query='*', Callback=c, Context=evttext)