当前位置:编程学习 > 网站相关 >>

读取windows系统日志的三种方式(powershellperlc#)

很易做图的写了三遍,用三种语言

—————————-C# ——————————-


using System;
using System.Diagnostics;
using System.Security;
using System.Text;

namespace glog
{
class Program
{
static void Main(string[] args)
{
String machine = "."; // local machine
Console.WriteLine(" Windows Log picker by Xti9er ");
Console.WriteLine("------------------------------------------------------------- ");
if (args.Length == 1)
{
if (args[0]=="application"||args[0]=="system"||args[0]=="security")
{
String log = args[0];
EventLog aLog = new EventLog(log, machine);

EventLogEntry entry;
EventLogEntryCollection entries = aLog.Entries;
for (int i = 0; i < entries.Count; i++)
{
entry = entries[i];
Console.WriteLine("[Index] " + entry.Index +
" [EventID] " + entry.EventID +
" [TimeWritten] " + entry.TimeWritten +
" [MachineName] " + entry.MachineName +
" [Source] " + entry.Source +
" [UserName] " + entry.UserName +
" [Message] " + entry.Message +
" --------------------------------------------------- ");
}
}
else
{
Console.WriteLine("Usage:glog.exe system(application,security) ");
}
}
else{
Console.WriteLine("Usage:glog.exe system(application,security) ");
}
}
}
}

—————————-perl——————————-

use Win32::EventLog;

my $logname=shift||die "$0 system(applicationsecurity)";
open(LOGF,"+>>$logname.txt") or goto GETLOGEND;
$handle=Win32::EventLog->new($logname, $ENV{ComputerName})
or die "Cant open Application EventLog ";
$handle->GetNumber($recs)
or die "Cant get number of EventLog records ";
$handle->GetOldest($base)
or die "Cant get number of oldest EventLog record ";

while ($x < $recs) {
$handle->Read(EVENTLOG_FORWARDS_READ|EVENTLOG_SEEK_READ,
$base+$x,
$hashRef)
or die "Cant read EventLog entry #$x ";

print LOGF localtime($hashRef->{Timewritten})." $hashRef->{EventType} $hashRef->{Category} $hashRef->{Source}";

Win32::EventLog::GetMessageText($hashRef);
my $log_Message=$hashRef->{Message};
$log_Message=~s/ //g;
$log_Message=~s///g;
print LOGF $log_Message." ";

$x++;
}
close LOGF;
GETLOGEND:
—————————-powershell——————————-

Get-EventLog system|foreach -process{echo $_.Index,$_.EventID,$_.TimeWritten,$_.MachineName,$_.Source,$_.UserName,$_.Message,"----------------"}
 

补充:综合编程 , 安全编程 ,
CopyRight © 2022 站长资源库 编程知识问答 zzzyk.com All Rights Reserved
部分文章来自网络,