//read eventlogs from system part of a remote machine or list of remote machines and write at a csv at will
using System;
using System.IO;
using System.Diagnostics;
using System.Text.RegularExpressions;
class MyEventLogClass
{
public static void Main(string[] Arg)
{
string[] myHostName= new String [10000];
string myEventType= null;
string strLogFile= "NoLog";
int myArgLength=0;
int myEventID=-1;
//check arguments
//nothing means user will be asked for hostname, Event Type and ID
//one parameter it should be HOSTNAMELISTFILE as Textlist but ask for EventType and ID
//three parameters should be HOSTNAMELISTFILE EventType EventID
//four parameters should be HOSTNAMELISTFILE EventType EventID LogFile
try
{
myArgLength= Arg.Length;
switch(myArgLength)
{
case 0 :
myHostName[0] = MyEventLogClass.getHostname();
break;
case 1 :
myHostName = MyEventLogClass.getHostNameList(Arg[0]);
break;
case 3 :
myHostName = MyEventLogClass.getHostNameList(Arg[0]);
myEventType = Arg[1];
myEventID = int.Parse(Arg[2]);
break;
case 4 :
myHostName = MyEventLogClass.getHostNameList(Arg[0]);
myEventType = Arg[1];
myEventID = int.Parse(Arg[2]);
strLogFile = Arg[3];
break;
default:
MyEventLogClass.writeHelp();
break;
}
}
catch
{
myHostName[0] = MyEventLogClass.getHostname();
}
//get EventType and ID if not set
if ((myEventType == "") || (myEventType == null))
{
myEventType = MyEventLogClass.getEventType();
}
if (myEventID < 0)
{
myEventID = MyEventLogClass.getEventID();
}
//if LogFile wanted prepare header in csv style
if (!(strLogFile.Equals("NoLog")))
{
try
{
File.WriteAllText(strLogFile, "EventID, EntryType, UserName, Source, MachineName, Index, Data, Message\n");
}
catch
{
Console.WriteLine("Failure during access to {0}", strLogFile);
Environment.Exit (-1);
}
}
//Call Eventsearch for each given Hostname
foreach(string strHost in myHostName)
{
if(( strHost != "") || ( strHost != "#") || ( strHost != null))
{
MyEventLogClass.getEvent(strHost, myEventType, myEventID, strLogFile);
}
}
Console.WriteLine("\n\nEventlog scan done with these Parameters");
Console.WriteLine("Hostname \t{0}", myHostName);
Console.WriteLine("EventType \t{0}", myEventType);
Console.WriteLine("EventID \t{0}", myEventID);
Console.WriteLine("LogFile \t{0}", strLogFile);
//end of Main
}
private static void getEvent(string myHostName, string myEventType, int myEventID, string strLogFile)
{
int myCount=0;
string mystrLog= null;
//create a regular expression that matches one or more Line breaks
Regex rgx = new Regex("[\n\b\r]");
// catch if myHostName is nothing realy
if(( myHostName == "") || ( myHostName == "#") || ( myHostName == null))
{
return;
}
Console.WriteLine("\nSearching " + myHostName + " " + myEventType + " " + myEventID + "\n");
// Associate the instance of 'EventLog' myHostName's System Log
EventLog myEventLog = new EventLog("System", ".");
myEventLog.MachineName = myHostName;
// Get Object Instance EventLog Collection
EventLogEntryCollection myLogEntryCollection=myEventLog.Entries;
myCount =myLogEntryCollection.Count;
// Iterate through all 'EventLogEntry' instances in 'EventLog'.
for(int i=myCount-1;i>0;i--)
{
EventLogEntry myLogEntry = myLogEntryCollection[i];
// get the entries having desired EventType AND EventID
if(((myLogEntry.EntryType.ToString().Equals(myEventType))) && myLogEntry.EventID.Equals(myEventID))
{
// Display Source of the event.
Console.WriteLine("Data {0}", myLogEntry.Data);
Console.WriteLine("EntryType {0}", myLogEntry.EntryType);
Console.WriteLine("EventID {0}", myLogEntry.EventID);
Console.WriteLine("Index {0}", myLogEntry.Index);
Console.WriteLine("MachineName {0}", myLogEntry.MachineName);
Console.WriteLine("Source {0}", myLogEntry.Source);
Console.WriteLine("TimeGenerated {0}", myLogEntry.TimeGenerated);
Console.WriteLine("Type {0}", myLogEntry.EntryType);
Console.WriteLine("UserName {0}", myLogEntry.UserName);
Console.WriteLine("Messages {0}", (rgx.Replace(myLogEntry.Message, "")));
//write Log if wanted to
if (!(strLogFile.Equals("NoLog")))
{
mystrLog= (myLogEntry.EventID + "," +
myLogEntry.EntryType + "," +
myLogEntry.UserName + "," +
myLogEntry.Source + "," +
myLogEntry.MachineName + "," +
myLogEntry.Index + "," +
myLogEntry.Data + "," +
(rgx.Replace(myLogEntry.Message, "")));
try
{
using (StreamWriter sWriter= File.AppendText(strLogFile))
{
sWriter.WriteLine(mystrLog);
}
}
catch
{
Console.WriteLine("Failure during access to {0}", strLogFile);
Environment.Exit (-1);
}
}
//take out the remark to get only the Last entry
//return;
}
}
}
private static string[] getHostNameList(string myListFileName)
{
// write Help if has been asked for
if ((myListFileName.Equals("?"))||(myListFileName.Equals("/?")))
{
MyEventLogClass.writeHelp();
}
//Exit Program if Hostname file not found
if (!File.Exists(myListFileName))
{
Console.WriteLine("File {0} not found", myListFileName);
Environment.Exit (-1);
}
string[] myEntry= new String[10000];
myEntry = File.ReadAllLines(myListFileName);
return myEntry;
}
private static string getHostname()
{
String myHostName=System.Environment.MachineName;
// get search parameters Hostname,EventType and EventID
Console.WriteLine("\n Please Enter Hostname");
Console.WriteLine("Default {0}", myHostName);
try
{
myHostName=Convert.ToString(Console.ReadLine());
}
catch(Exception)
{
myHostName =System.Environment.MachineName;
}
if (myHostName.Equals(""))
{
myHostName =System.Environment.MachineName;
}
return myHostName;
}
private static string getEventType()
{
String myEventType=null;
int myOption=0;
// get EvenType
Console.WriteLine("\n Select the Event Type");
Console.WriteLine("(1):Error 2:Information 3:Warning");
// get user choice
try
{
myOption=Convert.ToInt16(Console.ReadLine());
}
catch(Exception)
{
myOption=1;
}
switch(myOption)
{
case 1: myEventType="Error";
break;
case 2: myEventType="Information";
break;
case 3: myEventType="Warning";
break;
default: myEventType="Error";
break;
}
return myEventType;
}
private static int getEventID()
{
int myEventID=0;
// get EventID
Console.WriteLine("\n Select the Event ID Number default is 0");
try
{
myEventID=Convert.ToInt16(Console.ReadLine());
}
catch(Exception)
{
myEventID=0;
}
return myEventID;
}
private static void writeHelp()
{
Console.WriteLine("\nEventlog.exe is a .Net application to collect event entries from system log");
Console.WriteLine("\nParameters Can be ? or HOSTNAMEFILE and EventType + EventID");
Console.WriteLine("\nParameters:");
Console.WriteLine("Eventlog HOSTNAMEFILE");
Console.WriteLine("Eventlog HOSTNAMEFILE EventType EventID");
Console.WriteLine("Eventlog HOSTNAMEFILE EventType EventID LOGFILENAME");
Console.WriteLine("Example for a search of DCOM caused 100016 Errors:");
Console.WriteLine("Eventlog Hostnames.txt Error 100016 DCOM_Errors.csv");
Environment.Exit (-1);
}
}