private static void Initialize()
{
#region EventCategories
var eventDescriptionsFilePath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "EventDescriptions.xml");
if (File.Exists(eventDescriptionsFilePath))
{
var eventDescriptions = new List <EventDescription>();
using (var fileStream = new FileStream(eventDescriptionsFilePath, FileMode.Open, FileAccess.Read)) {
var xmlSerializer = new XmlSerializer(typeof(List <EventDescription>));
eventDescriptions = xmlSerializer.Deserialize(fileStream) as List <EventDescription>;
}
foreach (var eventDescription in eventDescriptions)
{
if (!eventDescription.IsValid())
{
throw new ApplicationException($"EventDescription is not valid: {eventDescription}");
}
var key = $"{eventDescription.EventLog.Trim()}-Id-{eventDescription.EventId}";
if (!EventDescriptions.ContainsKey(key))
{
EventDescriptions.Add(key, eventDescription);
}
else
{
throw new ApplicationException($"EventDescriptions already contains entry for: {eventDescription}");
}
}
Console.WriteLine("EventDescriptions:");
foreach (var eventDescription in EventDescriptions.Values)
{
Console.WriteLine($" - {eventDescription}");
}
}
#endregion
#region EventLogQueryReverseDirection
if (ConfigurationManager.AppSettings["EventLogQueryReverseDirection"] != null)
{
EventLogQueryReverseDirection = Convert.ToBoolean(ConfigurationManager.AppSettings["EventLogQueryReverseDirection"]);
}
else
{
EventLogQueryReverseDirection = true;
}
Console.WriteLine($"EventLogQueryReverseDirection: {EventLogQueryReverseDirection}");
#endregion
}
private static void CreateXMLReport(string reportFileBasePath)
{
Console.WriteLine($"{DateTime.Now.YMDHMSFriendly()} - {ObjectExtensions.CurrentMethodName()}");
#region Validation
if (string.IsNullOrWhiteSpace(reportFileBasePath))
{
throw new ArgumentNullException("reportFileBasePath");
}
#endregion
foreach (var kvpEventData in EventData)
{
Console.WriteLine($" - EventId: {kvpEventData.Key} Events: {kvpEventData.Value.Count}");
var rootElement = new XElement($"ArrayOfEventId{kvpEventData.Key.Replace("/", "-").Replace("+", "-")}");
var firstEvent = DateTime.MaxValue;
var lastEvent = DateTime.MinValue;
foreach (var eventBase in kvpEventData.Value)
{
if (eventBase.DateTimeUTC < firstEvent)
{
firstEvent = eventBase.DateTimeUTC;
}
if (eventBase.DateTimeUTC > lastEvent)
{
lastEvent = eventBase.DateTimeUTC;
}
#region Element values for all events/lines
var eventChildElement = new XElement("Event");
eventChildElement.Add(new XElement("EventId", eventBase.EventId));
eventChildElement.Add(new XElement("EventRecordId", eventBase.EventRecordId));
eventChildElement.Add(new XElement("EventSourceMachine", eventBase.EventSourceMachine ?? "NULL"));
eventChildElement.Add(new XElement("DateTimeUTC", eventBase.DateTimeUTC.YMDHMSFriendly()));
eventChildElement.Add(new XElement("Channel", eventBase.Channel));
eventChildElement.Add(new XElement("Level", eventBase.Level));
#endregion
#region Get element values unique for the event
foreach (var elementName in EventColumns[eventBase.EventKey].Keys)
{
var elementValue = "N/A";
if ((eventBase.EventDataNameElements != null) && (eventBase.EventDataNameElements.Count > 0))
{
var columnElement = eventBase.EventDataNameElements
.Where(x => x.Attributes()
.Any(y =>
(y != null) && (y.Name != null) && !string.IsNullOrWhiteSpace(y.Name.LocalName) &&
string.Equals(y.Name.LocalName, "Name", StringComparison.OrdinalIgnoreCase) &&
!string.IsNullOrWhiteSpace(y.Value) &&
string.Equals(y.Value, elementName, StringComparison.OrdinalIgnoreCase)))
.FirstOrDefault();
if ((columnElement != null) && (columnElement.Value != null))
{
elementValue = columnElement.Value.Trim();
if (string.IsNullOrWhiteSpace(elementValue))
{
elementValue = "N/A";
}
}
}
eventChildElement.Add(new XElement(elementName, elementValue));
}
#endregion
rootElement.Add(eventChildElement);
} // foreach (var eventBase in kvpEventData.Value) {
#region Create report for the specific event id
var eventDescription = string.Empty;
if (EventDescriptions.ContainsKey(kvpEventData.Key))
{
eventDescription = $"-{EventDescriptions[kvpEventData.Key].Description}";
}
var reportFileName = $"Event-{kvpEventData.Key.Replace("/","-")}{eventDescription}-{firstEvent.YMDHMFriendly().Replace(":", "-").Replace(" ", "-")}-{lastEvent.YMDHMFriendly().Replace(":", "-").Replace(" ", "-")}.xml";
var reportFilePath = Path.Combine(reportFileBasePath, reportFileName);
var xDocument = new XDocument(new XDeclaration("1.0", "UTF-8", string.Empty), rootElement);
try {
Console.WriteLine($"{DateTime.Now.YMDHMSFriendly()} - {ObjectExtensions.CurrentMethodName()} Writing: {rootElement.Elements().Count()} events to file: {reportFilePath}");
xDocument.Save(reportFilePath);
}
catch (Exception e) {
Console.ForegroundColor = ConsoleColor.Red;
Console.WriteLine("Error parsing events");
Console.WriteLine(e.VerboseExceptionString());
Console.ResetColor();
}
#endregion
} // foreach (var kvpEventData in EventData) {
}
private static void CreateCSVReport(string reportFileBasePath)
{
Console.WriteLine($"{DateTime.Now.YMDHMSFriendly()} - {ObjectExtensions.CurrentMethodName()}");
#region Validation
if (string.IsNullOrWhiteSpace(reportFileBasePath))
{
throw new ArgumentNullException("reportFileBasePath");
}
#endregion
foreach (var kvpEventData in EventData)
{
Console.WriteLine($" - EventId: {kvpEventData.Key} Events: {kvpEventData.Value.Count}");
var lines = new List <string>();
var headerLine = new StringBuilder();
#region Column headers for all events
headerLine.Append("EventId,");
headerLine.Append("EventRecordId,");
headerLine.Append("EventSourceMachine,");
headerLine.Append("DateTimeUTC,");
headerLine.Append("Channel,");
headerLine.Append("Level,");
#endregion
foreach (var kvpColumnName in EventColumns[kvpEventData.Key])
{
headerLine.Append($"{kvpColumnName.Key},");
}
lines.Add(headerLine.ToString());
var firstEvent = DateTime.MaxValue;
var lastEvent = DateTime.MinValue;
foreach (var eventBase in kvpEventData.Value)
{
if (eventBase.DateTimeUTC < firstEvent)
{
firstEvent = eventBase.DateTimeUTC;
}
if (eventBase.DateTimeUTC > lastEvent)
{
lastEvent = eventBase.DateTimeUTC;
}
var line = new StringBuilder();
#region Column values for all events/lines
line.Append($"{eventBase.EventId},");
line.Append($"{eventBase.EventRecordId},");
line.Append($"{eventBase.EventSourceMachine ?? string.Empty},");
line.Append($"{eventBase.DateTimeUTC.YMDHMSFFFFFFFFriendly()},");
line.Append($"{eventBase.Channel},");
line.Append($"{eventBase.Level},");
#endregion
#region Get column values for the line
foreach (var columnName in EventColumns[eventBase.EventKey].Keys)
{
var columnValue = "N/A,";
if ((eventBase.EventDataNameElements != null) && (eventBase.EventDataNameElements.Count > 0))
{
var columnElement = eventBase.EventDataNameElements
.Where(x => x.Attributes()
.Any(y =>
(y != null) && (y.Name != null) && !string.IsNullOrWhiteSpace(y.Name.LocalName) &&
string.Equals(y.Name.LocalName, "Name", StringComparison.OrdinalIgnoreCase) &&
!string.IsNullOrWhiteSpace(y.Value) &&
string.Equals(y.Value, columnName, StringComparison.OrdinalIgnoreCase)))
.FirstOrDefault();
if ((columnElement != null) && (columnElement.Value != null))
{
columnValue = columnElement.Value.Trim();
}
}
line.Append($"\"{columnValue}\",");
}
#endregion
lines.Add(line.ToString());
} // foreach (var eventBase in kvpEventData.Value) {
#region Create report for the specific event id
var eventDescription = string.Empty;
if (EventDescriptions.ContainsKey(kvpEventData.Key))
{
eventDescription = $"-{EventDescriptions[kvpEventData.Key].Description}";
}
var reportFileName = $"EventId-{kvpEventData.Key.Replace("/","-")}{eventDescription}-{firstEvent.YMDHMFriendly().Replace(":", "-").Replace(" ", "-")}-{lastEvent.YMDHMFriendly().Replace(":", "-").Replace(" ", "-")}.csv";
var reportFilePath = Path.Combine(reportFileBasePath, reportFileName);
try {
Console.WriteLine($"{DateTime.Now.YMDHMSFriendly()} - {ObjectExtensions.CurrentMethodName()} Writing: {lines.Count} lines to file: {reportFilePath}");
File.WriteAllLines(reportFilePath, lines, Encoding.UTF8);
}
catch (Exception e) {
Console.ForegroundColor = ConsoleColor.Red;
Console.WriteLine("Error parsing events");
Console.WriteLine(e.VerboseExceptionString());
Console.ResetColor();
}
#endregion
} // foreach (var kvpEventData in EventData) {
}
