Feedback

C# - Eventlog Eintrag finden

Veröffentlicht von am 05.09.2006
(2 Bewertungen)
Sucht einen Eventlog Eintrag bei einer(oder einer List)von Maschine(n) im System Log und schreibt diesen in ein CSV
//read eventlogs from system part of a remote machine or list of remote machines and write at a csv at will

using System;
using System.IO;
using System.Diagnostics;
using System.Text.RegularExpressions;

class MyEventLogClass
{
	public static void Main(string[] Arg)
	{
		string[] myHostName= new String [10000];
		string myEventType= null;
		string strLogFile= "NoLog";
		int myArgLength=0;
		int myEventID=-1;
		
		//check arguments
		//nothing means user will be asked for hostname, Event Type and ID
		//one parameter it should be HOSTNAMELISTFILE as Textlist but ask for EventType and ID
		//three parameters should be HOSTNAMELISTFILE EventType EventID
		//four parameters should be HOSTNAMELISTFILE EventType EventID LogFile
		try
		{
			myArgLength= Arg.Length;
			switch(myArgLength)
			{
				case 0 : 
						myHostName[0] = MyEventLogClass.getHostname();
						break;
				case 1 : 
						myHostName = MyEventLogClass.getHostNameList(Arg[0]);
						break;
				case 3 : 
						myHostName = MyEventLogClass.getHostNameList(Arg[0]);
						myEventType = Arg[1]; 
						myEventID = int.Parse(Arg[2]);
						break;
				case 4 : 
						myHostName = MyEventLogClass.getHostNameList(Arg[0]);
						myEventType = Arg[1]; 
						myEventID = int.Parse(Arg[2]);
						strLogFile = Arg[3];
						break;
				default: 
						MyEventLogClass.writeHelp();
						break;
			}
		}
		catch
		{
			myHostName[0] = MyEventLogClass.getHostname();
		}
		
		//get EventType and ID if not set
		if ((myEventType == "") || (myEventType == null))
		{
			myEventType = MyEventLogClass.getEventType();
		}
		if (myEventID < 0)
		{
			myEventID = MyEventLogClass.getEventID();
		}
		
		//if LogFile wanted prepare header in csv style
		if (!(strLogFile.Equals("NoLog")))
		{
			try
			{
				File.WriteAllText(strLogFile, "EventID, EntryType, UserName, Source, MachineName, Index, Data, Message\n");
			}
			catch
			{
				Console.WriteLine("Failure during access to {0}", strLogFile);
				Environment.Exit (-1);
			}			
		}
		//Call Eventsearch for each given Hostname
		foreach(string strHost in myHostName)
		{
			if(( strHost != "") || ( strHost != "#") || ( strHost != null))
			{
				MyEventLogClass.getEvent(strHost, myEventType, myEventID, strLogFile);
			}
		}
		Console.WriteLine("\n\nEventlog scan done with these Parameters");
		Console.WriteLine("Hostname \t{0}", myHostName);
		Console.WriteLine("EventType \t{0}", myEventType);
		Console.WriteLine("EventID \t{0}", myEventID);
		Console.WriteLine("LogFile \t{0}", strLogFile);
		//end of Main		
	}
	
	private static void getEvent(string myHostName, string myEventType, int myEventID, string strLogFile)
	{
		int myCount=0;
		string mystrLog= null;
			
		//create a regular expression that matches one or more Line breaks
		Regex rgx = new Regex("[\n\b\r]");
		
		// catch if myHostName is nothing realy
		if(( myHostName == "") || ( myHostName == "#") || ( myHostName == null))
		{
			return;
		}
		Console.WriteLine("\nSearching " + myHostName + " " + myEventType + " " + myEventID + "\n");
		
		// Associate the instance of 'EventLog' myHostName's System Log
		EventLog myEventLog = new EventLog("System", ".");
		myEventLog.MachineName = myHostName;

		// Get Object Instance EventLog Collection
		EventLogEntryCollection myLogEntryCollection=myEventLog.Entries;
		myCount =myLogEntryCollection.Count;
		
		// Iterate through all 'EventLogEntry' instances in 'EventLog'.
		for(int i=myCount-1;i>0;i--)
		{
			EventLogEntry myLogEntry = myLogEntryCollection[i];
			
			// get the entries having desired EventType AND EventID
			if(((myLogEntry.EntryType.ToString().Equals(myEventType))) && myLogEntry.EventID.Equals(myEventID))
			{
				// Display Source of the event.
				Console.WriteLine("Data				{0}", myLogEntry.Data);
				Console.WriteLine("EntryType			{0}", myLogEntry.EntryType);
				Console.WriteLine("EventID				{0}", myLogEntry.EventID);
				Console.WriteLine("Index				{0}", myLogEntry.Index);
				Console.WriteLine("MachineName			{0}", myLogEntry.MachineName);
				Console.WriteLine("Source				{0}", myLogEntry.Source);
				Console.WriteLine("TimeGenerated			{0}", myLogEntry.TimeGenerated);
				Console.WriteLine("Type				{0}", myLogEntry.EntryType);
				Console.WriteLine("UserName				{0}", myLogEntry.UserName);
				Console.WriteLine("Messages			{0}", (rgx.Replace(myLogEntry.Message, "")));
				
				//write Log if wanted to
				if (!(strLogFile.Equals("NoLog")))
				{
					mystrLog=	(myLogEntry.EventID + "," + 
								myLogEntry.EntryType + "," +
								myLogEntry.UserName + "," + 
								myLogEntry.Source + "," +
								myLogEntry.MachineName + "," +
								myLogEntry.Index + "," +
								myLogEntry.Data + "," +
								(rgx.Replace(myLogEntry.Message, "")));
					try
					{
						using (StreamWriter sWriter= File.AppendText(strLogFile))
						{
							sWriter.WriteLine(mystrLog);							
						}
					}
					catch
					{
						Console.WriteLine("Failure during access to {0}", strLogFile);
						Environment.Exit (-1);
					}
				}
				//take out the remark to get only the Last entry
				//return;
			}
		}
	}
	
	private static string[] getHostNameList(string myListFileName)
	{
		// write Help if has been asked for
		if ((myListFileName.Equals("?"))||(myListFileName.Equals("/?")))
		{
			MyEventLogClass.writeHelp();
		}
		//Exit Program if Hostname file not found
		if (!File.Exists(myListFileName))
		{
			Console.WriteLine("File {0} not found", myListFileName);
			Environment.Exit (-1);
		}
		string[] myEntry= new String[10000];

		myEntry = File.ReadAllLines(myListFileName);
		return myEntry;
	}
	
	private static string getHostname()
	{
		String myHostName=System.Environment.MachineName;
		// get search parameters Hostname,EventType and EventID
		Console.WriteLine("\n Please Enter Hostname");
		Console.WriteLine("Default {0}", myHostName);
		try
		{
			myHostName=Convert.ToString(Console.ReadLine());
		}
		catch(Exception)
		{
			myHostName =System.Environment.MachineName;
		}
		if (myHostName.Equals(""))
		{
			myHostName =System.Environment.MachineName;
		}
		return myHostName;
	}

	private static string getEventType()
	{
		String myEventType=null;
		int myOption=0;
		// get EvenType
		Console.WriteLine("\n Select the Event Type");
		Console.WriteLine("(1):Error 2:Information 3:Warning");
		// get user choice
		try
		{
			myOption=Convert.ToInt16(Console.ReadLine());
		}
		catch(Exception)
		{
			myOption=1;
		}
		switch(myOption)
		{
			case 1:  myEventType="Error";
				break;
			case 2:  myEventType="Information";
				break;
			case 3:  myEventType="Warning";
				break;
			default: myEventType="Error";
				break;
		}
		return myEventType;
	}
	
	private static int getEventID()
	{
		int myEventID=0;
		// get EventID
		Console.WriteLine("\n Select the Event ID Number default is 0");
		try
		{
			myEventID=Convert.ToInt16(Console.ReadLine());
		}
		catch(Exception)
		{
			myEventID=0;
		}
		return myEventID;
	}
	
	private static void writeHelp()
	{
		Console.WriteLine("\nEventlog.exe is a .Net application to collect event entries from system log");
		Console.WriteLine("\nParameters Can be ? or HOSTNAMEFILE and EventType + EventID");
		Console.WriteLine("\nParameters:");
		Console.WriteLine("Eventlog HOSTNAMEFILE");
		Console.WriteLine("Eventlog HOSTNAMEFILE EventType EventID");
		Console.WriteLine("Eventlog HOSTNAMEFILE EventType EventID LOGFILENAME");
		Console.WriteLine("Example for a search of DCOM caused 100016 Errors:");
		Console.WriteLine("Eventlog Hostnames.txt Error 100016 DCOM_Errors.csv");
		Environment.Exit (-1);		
	}
}

Abgelegt unter EventLog, remote, csv.

Kommentare zum Snippet

 

Logge dich ein, um hier zu kommentieren!