/// <summary>
/// Gets basic event information.
/// </summary>
/// <param name="log">The event's log.</param>
/// <param name="source">The event's source. Can be <c>null</c>.</param>
/// <param name="eventId">The event's id. Can be <c>null</c>.</param>
/// <returns><c>true</c> if subscription represents a basic event, <c>false</c> if not.</returns>
public bool GetBasic(out string log, out string source, out int? eventId)
{
log = source = null;
eventId = null;
if (!string.IsNullOrEmpty(this.Subscription))
{
using (System.IO.MemoryStream str = new System.IO.MemoryStream(System.Text.Encoding.UTF8.GetBytes(this.Subscription)))
{
using (System.Xml.XmlTextReader rdr = new System.Xml.XmlTextReader(str))
{
rdr.MoveToContent();
rdr.ReadStartElement("QueryList");
if (rdr.Name == "Query" && rdr.MoveToAttribute("Path"))
{
string path = rdr.Value;
if (rdr.MoveToElement() && rdr.ReadToDescendant("Select") && path.Equals(rdr["Path"], StringComparison.InvariantCultureIgnoreCase))
{
string content = rdr.ReadString();
System.Text.RegularExpressions.Match m = System.Text.RegularExpressions.Regex.Match(content,
@"\*(?:\[System\[(?:Provider\[\@Name='(?<s>[^']+)'\])?(?:\s+and\s+)?(?:EventID=(?<e>\d+))?\]\])",
System.Text.RegularExpressions.RegexOptions.IgnoreCase |
System.Text.RegularExpressions.RegexOptions.Compiled |
System.Text.RegularExpressions.RegexOptions.Singleline |
System.Text.RegularExpressions.RegexOptions.IgnorePatternWhitespace);
if (m.Success)
{
log = path;
if (m.Groups["s"].Success)
source = m.Groups["s"].Value;
if (m.Groups["e"].Success)
eventId = Convert.ToInt32(m.Groups["e"].Value);
return true;
}
}
}
}
}
}
return false;
}
