private static void Initialize() { #region EventCategories var eventDescriptionsFilePath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "EventDescriptions.xml"); if (File.Exists(eventDescriptionsFilePath)) { var eventDescriptions = new List <EventDescription>(); using (var fileStream = new FileStream(eventDescriptionsFilePath, FileMode.Open, FileAccess.Read)) { var xmlSerializer = new XmlSerializer(typeof(List <EventDescription>)); eventDescriptions = xmlSerializer.Deserialize(fileStream) as List <EventDescription>; } foreach (var eventDescription in eventDescriptions) { if (!eventDescription.IsValid()) { throw new ApplicationException($"EventDescription is not valid: {eventDescription}"); } var key = $"{eventDescription.EventLog.Trim()}-Id-{eventDescription.EventId}"; if (!EventDescriptions.ContainsKey(key)) { EventDescriptions.Add(key, eventDescription); } else { throw new ApplicationException($"EventDescriptions already contains entry for: {eventDescription}"); } } Console.WriteLine("EventDescriptions:"); foreach (var eventDescription in EventDescriptions.Values) { Console.WriteLine($" - {eventDescription}"); } } #endregion #region EventLogQueryReverseDirection if (ConfigurationManager.AppSettings["EventLogQueryReverseDirection"] != null) { EventLogQueryReverseDirection = Convert.ToBoolean(ConfigurationManager.AppSettings["EventLogQueryReverseDirection"]); } else { EventLogQueryReverseDirection = true; } Console.WriteLine($"EventLogQueryReverseDirection: {EventLogQueryReverseDirection}"); #endregion }
private static void CreateXMLReport(string reportFileBasePath) { Console.WriteLine($"{DateTime.Now.YMDHMSFriendly()} - {ObjectExtensions.CurrentMethodName()}"); #region Validation if (string.IsNullOrWhiteSpace(reportFileBasePath)) { throw new ArgumentNullException("reportFileBasePath"); } #endregion foreach (var kvpEventData in EventData) { Console.WriteLine($" - EventId: {kvpEventData.Key} Events: {kvpEventData.Value.Count}"); var rootElement = new XElement($"ArrayOfEventId{kvpEventData.Key.Replace("/", "-").Replace("+", "-")}"); var firstEvent = DateTime.MaxValue; var lastEvent = DateTime.MinValue; foreach (var eventBase in kvpEventData.Value) { if (eventBase.DateTimeUTC < firstEvent) { firstEvent = eventBase.DateTimeUTC; } if (eventBase.DateTimeUTC > lastEvent) { lastEvent = eventBase.DateTimeUTC; } #region Element values for all events/lines var eventChildElement = new XElement("Event"); eventChildElement.Add(new XElement("EventId", eventBase.EventId)); eventChildElement.Add(new XElement("EventRecordId", eventBase.EventRecordId)); eventChildElement.Add(new XElement("EventSourceMachine", eventBase.EventSourceMachine ?? "NULL")); eventChildElement.Add(new XElement("DateTimeUTC", eventBase.DateTimeUTC.YMDHMSFriendly())); eventChildElement.Add(new XElement("Channel", eventBase.Channel)); eventChildElement.Add(new XElement("Level", eventBase.Level)); #endregion #region Get element values unique for the event foreach (var elementName in EventColumns[eventBase.EventKey].Keys) { var elementValue = "N/A"; if ((eventBase.EventDataNameElements != null) && (eventBase.EventDataNameElements.Count > 0)) { var columnElement = eventBase.EventDataNameElements .Where(x => x.Attributes() .Any(y => (y != null) && (y.Name != null) && !string.IsNullOrWhiteSpace(y.Name.LocalName) && string.Equals(y.Name.LocalName, "Name", StringComparison.OrdinalIgnoreCase) && !string.IsNullOrWhiteSpace(y.Value) && string.Equals(y.Value, elementName, StringComparison.OrdinalIgnoreCase))) .FirstOrDefault(); if ((columnElement != null) && (columnElement.Value != null)) { elementValue = columnElement.Value.Trim(); if (string.IsNullOrWhiteSpace(elementValue)) { elementValue = "N/A"; } } } eventChildElement.Add(new XElement(elementName, elementValue)); } #endregion rootElement.Add(eventChildElement); } // foreach (var eventBase in kvpEventData.Value) { #region Create report for the specific event id var eventDescription = string.Empty; if (EventDescriptions.ContainsKey(kvpEventData.Key)) { eventDescription = $"-{EventDescriptions[kvpEventData.Key].Description}"; } var reportFileName = $"Event-{kvpEventData.Key.Replace("/","-")}{eventDescription}-{firstEvent.YMDHMFriendly().Replace(":", "-").Replace(" ", "-")}-{lastEvent.YMDHMFriendly().Replace(":", "-").Replace(" ", "-")}.xml"; var reportFilePath = Path.Combine(reportFileBasePath, reportFileName); var xDocument = new XDocument(new XDeclaration("1.0", "UTF-8", string.Empty), rootElement); try { Console.WriteLine($"{DateTime.Now.YMDHMSFriendly()} - {ObjectExtensions.CurrentMethodName()} Writing: {rootElement.Elements().Count()} events to file: {reportFilePath}"); xDocument.Save(reportFilePath); } catch (Exception e) { Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("Error parsing events"); Console.WriteLine(e.VerboseExceptionString()); Console.ResetColor(); } #endregion } // foreach (var kvpEventData in EventData) { }
private static void CreateCSVReport(string reportFileBasePath) { Console.WriteLine($"{DateTime.Now.YMDHMSFriendly()} - {ObjectExtensions.CurrentMethodName()}"); #region Validation if (string.IsNullOrWhiteSpace(reportFileBasePath)) { throw new ArgumentNullException("reportFileBasePath"); } #endregion foreach (var kvpEventData in EventData) { Console.WriteLine($" - EventId: {kvpEventData.Key} Events: {kvpEventData.Value.Count}"); var lines = new List <string>(); var headerLine = new StringBuilder(); #region Column headers for all events headerLine.Append("EventId,"); headerLine.Append("EventRecordId,"); headerLine.Append("EventSourceMachine,"); headerLine.Append("DateTimeUTC,"); headerLine.Append("Channel,"); headerLine.Append("Level,"); #endregion foreach (var kvpColumnName in EventColumns[kvpEventData.Key]) { headerLine.Append($"{kvpColumnName.Key},"); } lines.Add(headerLine.ToString()); var firstEvent = DateTime.MaxValue; var lastEvent = DateTime.MinValue; foreach (var eventBase in kvpEventData.Value) { if (eventBase.DateTimeUTC < firstEvent) { firstEvent = eventBase.DateTimeUTC; } if (eventBase.DateTimeUTC > lastEvent) { lastEvent = eventBase.DateTimeUTC; } var line = new StringBuilder(); #region Column values for all events/lines line.Append($"{eventBase.EventId},"); line.Append($"{eventBase.EventRecordId},"); line.Append($"{eventBase.EventSourceMachine ?? string.Empty},"); line.Append($"{eventBase.DateTimeUTC.YMDHMSFFFFFFFFriendly()},"); line.Append($"{eventBase.Channel},"); line.Append($"{eventBase.Level},"); #endregion #region Get column values for the line foreach (var columnName in EventColumns[eventBase.EventKey].Keys) { var columnValue = "N/A,"; if ((eventBase.EventDataNameElements != null) && (eventBase.EventDataNameElements.Count > 0)) { var columnElement = eventBase.EventDataNameElements .Where(x => x.Attributes() .Any(y => (y != null) && (y.Name != null) && !string.IsNullOrWhiteSpace(y.Name.LocalName) && string.Equals(y.Name.LocalName, "Name", StringComparison.OrdinalIgnoreCase) && !string.IsNullOrWhiteSpace(y.Value) && string.Equals(y.Value, columnName, StringComparison.OrdinalIgnoreCase))) .FirstOrDefault(); if ((columnElement != null) && (columnElement.Value != null)) { columnValue = columnElement.Value.Trim(); } } line.Append($"\"{columnValue}\","); } #endregion lines.Add(line.ToString()); } // foreach (var eventBase in kvpEventData.Value) { #region Create report for the specific event id var eventDescription = string.Empty; if (EventDescriptions.ContainsKey(kvpEventData.Key)) { eventDescription = $"-{EventDescriptions[kvpEventData.Key].Description}"; } var reportFileName = $"EventId-{kvpEventData.Key.Replace("/","-")}{eventDescription}-{firstEvent.YMDHMFriendly().Replace(":", "-").Replace(" ", "-")}-{lastEvent.YMDHMFriendly().Replace(":", "-").Replace(" ", "-")}.csv"; var reportFilePath = Path.Combine(reportFileBasePath, reportFileName); try { Console.WriteLine($"{DateTime.Now.YMDHMSFriendly()} - {ObjectExtensions.CurrentMethodName()} Writing: {lines.Count} lines to file: {reportFilePath}"); File.WriteAllLines(reportFilePath, lines, Encoding.UTF8); } catch (Exception e) { Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("Error parsing events"); Console.WriteLine(e.VerboseExceptionString()); Console.ResetColor(); } #endregion } // foreach (var kvpEventData in EventData) { }