private MailboxAuditLogRecord ReadAuditLogRecord(ObjectId itemId, ExDateTime creationTime, string content) { MailboxAuditLogRecordId identity = new MailboxAuditLogRecordId(itemId); string mailboxResolvedName = MailboxAuditLogSearchWorker.ResolveMailboxOwnerName(this.mailboxUser); MailboxAuditLogEvent mailboxAuditLogEvent = AuditLogParseSerialize.ParseMailboxAuditRecord(identity, content, mailboxResolvedName, this.mailboxUser.Guid.ToString(), new DateTime?(creationTime.UniversalTime.ToLocalTime())); this.ResolveDisplayNames(mailboxAuditLogEvent); return(mailboxAuditLogEvent); }
private MailboxAuditLogRecord CompareLastAccessDatesAndPrepareUserRecord(List <string> logonTypes) { new List <MailboxAuditLogRecord>(); ExDateTime endDate = new ExDateTime(ExTimeZone.UtcTimeZone, this.searchCriteria.EndDateUtc.Value); ExDateTime startDate = new ExDateTime(ExTimeZone.UtcTimeZone, this.searchCriteria.StartDateUtc.Value); DateTime? lastAccessed = MailboxAuditLogSearchWorker.CompareLastAccessWithSearchCriteria(this.mailboxUser, startDate, endDate, logonTypes); if (lastAccessed != null) { MailboxAuditLogRecordId identity = new MailboxAuditLogRecordId(this.mailboxUser.Identity); string mailboxResolvedName = MailboxAuditLogSearchWorker.ResolveMailboxOwnerName(this.mailboxUser); return(new MailboxAuditLogRecord(identity, mailboxResolvedName, this.mailboxUser.Guid.ToString(), lastAccessed)); } return(null); }
private static MailboxAuditLogRecord GetLatestAccessDateAndPrepareUserRecord(ADUser user, string logonType) { DateTime?lastAccessed = null; if (logonType.Equals("External", StringComparison.OrdinalIgnoreCase)) { DateTime?dateTime = (DateTime?)user[ADRecipientSchema.AuditLastExternalAccess]; if (dateTime != null) { lastAccessed = dateTime; } } else if (logonType.Equals("Admin", StringComparison.OrdinalIgnoreCase)) { DateTime?dateTime2 = (DateTime?)user[ADRecipientSchema.AuditLastAdminAccess]; if (dateTime2 != null) { lastAccessed = dateTime2; } } else if (logonType.Equals("Delegate", StringComparison.OrdinalIgnoreCase)) { DateTime?dateTime3 = (DateTime?)user[ADRecipientSchema.AuditLastDelegateAccess]; if (dateTime3 != null) { lastAccessed = dateTime3; } } if (lastAccessed != null) { MailboxAuditLogRecordId identity = new MailboxAuditLogRecordId(user.Identity); string mailboxResolvedName = MailboxAuditLogSearchWorker.ResolveMailboxOwnerName(user); return(new MailboxAuditLogRecord(identity, mailboxResolvedName, user.Guid.ToString(), lastAccessed)); } return(null); }
public static MailboxAuditLogEvent ParseMailboxAuditRecord(MailboxAuditLogRecordId identity, string eventLog, string mailboxResolvedName, string guid, DateTime?lastAccessed) { MailboxAuditLogEvent mailboxAuditLogEvent = new MailboxAuditLogEvent(identity, mailboxResolvedName, guid, lastAccessed); using (StringReader stringReader = new StringReader(eventLog)) { PropertyParseSchema[] array = AuditLogParseSerialize.MailboxAuditLogRecordParseSchema; string[] array2 = new string[2]; string text; while ((text = stringReader.ReadLine()) != null) { if (text.Contains(".SourceItemId")) { MultiValuedProperty <MailboxAuditLogSourceItem> multiValuedProperty = mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceItems] as MultiValuedProperty <MailboxAuditLogSourceItem>; string itemId = text.Substring(text.IndexOf(":") + 1).Trim(); if ((text = stringReader.ReadLine()) == null) { MailboxAuditLogSourceItem item = MailboxAuditLogSourceItem.Parse(itemId, null, null); multiValuedProperty.Add(item); break; } array2[0] = text; text = stringReader.ReadLine(); array2[1] = text; string itemSubject = null; string itemFolderPathName = null; foreach (string text2 in array2) { if (text2 == null) { break; } if (text2.Contains(".SourceItemSubject")) { itemSubject = text2.Substring(text2.IndexOf(":") + 1).Trim(); } if (text2.Contains(".SourceItemFolderPathName")) { itemFolderPathName = text2.Substring(text2.IndexOf(":") + 1).Trim(); } } MailboxAuditLogSourceItem item2 = MailboxAuditLogSourceItem.Parse(itemId, itemSubject, itemFolderPathName); ((MultiValuedProperty <MailboxAuditLogSourceItem>)mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceItems]).Add(item2); if (text == null) { break; } } else if (text.Contains(".SourceFolderId")) { MultiValuedProperty <MailboxAuditLogSourceFolder> multiValuedProperty2 = mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceFolders] as MultiValuedProperty <MailboxAuditLogSourceFolder>; string folderId = text.Substring(text.IndexOf(":") + 1).Trim(); if ((text = stringReader.ReadLine()) == null) { MailboxAuditLogSourceFolder item3 = MailboxAuditLogSourceFolder.Parse(folderId, null); multiValuedProperty2.Add(item3); break; } string folderPathName = text.Substring(text.IndexOf(":") + 1).Trim(); MailboxAuditLogSourceFolder item4 = MailboxAuditLogSourceFolder.Parse(folderId, folderPathName); multiValuedProperty2.Add(item4); } else { PropertyParseSchema[] array4 = array; int j = 0; while (j < array4.Length) { PropertyParseSchema propertyParseSchema = array4[j]; if (text.StartsWith(propertyParseSchema.Label, StringComparison.OrdinalIgnoreCase) && text[propertyParseSchema.Label.Length] == ':') { object obj = propertyParseSchema.PropertyParser(text.Substring(propertyParseSchema.Label.Length + 1).Trim()); if (obj != null) { mailboxAuditLogEvent[propertyParseSchema.Property] = obj; break; } break; } else { j++; } } } } } return(mailboxAuditLogEvent); }