public static PmEvent Create(XmlReader xEvnt)
{
XElement xe = XElement.Load(xEvnt);
var pmEvent = new PmEvent
{
ProcessIndex = xe.Value <int>("ProcessIndex"),
Time_of_Day = xe.Value <DateTime>("Time_of_Day"),
Process_Name = xe.Value <string>("Process_Name"),
PID = xe.Value <int>("PID"),
Operation = xe.Value <string>("Operation"),
Path = xe.Value <string>("Path"),
Result = xe.Value <string>("Result"),
Detail = xe.Value <string>("Detail"),
Date___Time = xe.Value <DateTime>("Date___Time"),
Relative_Time = xe.Value <DateTime>("Relative_Time"),
Duration = xe.Value <double>("Duration"),
Event_Class = xe.Value <string>("Event_Class"),
Image_Path = xe.Value <string>("Image_Path"),
Company = xe.Value <string>("Company"),
Description = xe.Value <string>("Description"),
Version = xe.Value <Version>("Version"),
User = xe.Value <string>("User"),
Authentication_ID = xe.Value <string>("Authentication_ID"),
Session = xe.Value <string>("Session"),
Command_Line = xe.Value <string>("Command_Line"),
TID = xe.Value <int>("TID"),
Virtualized = xe.Value <bool>("Virtualized"),
Integrity = xe.Value <string>("Integrity"),
Category = xe.Value <string>("Category"),
Parent_PID = xe.Value <int>("Parent_PID"),
Architecture = xe.Value <string>("Architecture")
};
return(pmEvent);
}
public IEnumerable <PmEvent> GetEvents()
{
XmlReader reader = XmlReader.Create(_logPath);
reader.MoveToContent();
if (reader.ReadToFollowing("event"))
{
while (!reader.EOF)
{
XmlReader eventReader = reader.ReadSubtree();
var pmEvent = PmEvent.Create(eventReader);
yield return(pmEvent);
if (!reader.ReadToNextSibling("event"))
{
break;
}
}
}
}
public static PmEvent Create(XmlReader xEvnt)
{
XElement xe = XElement.Load(xEvnt);
var pmEvent = new PmEvent
{
ProcessIndex = xe.Value<int>("ProcessIndex"),
Time_of_Day = xe.Value<DateTime>("Time_of_Day"),
Process_Name = xe.Value<string>("Process_Name"),
PID = xe.Value<int>("PID"),
Operation = xe.Value<string>("Operation"),
Path = xe.Value<string>("Path"),
Result = xe.Value<string>("Result"),
Detail = xe.Value<string>("Detail"),
Date___Time = xe.Value<DateTime>("Date___Time"),
Relative_Time = xe.Value<DateTime>("Relative_Time"),
Duration = xe.Value<double>("Duration"),
Event_Class = xe.Value<string>("Event_Class"),
Image_Path = xe.Value<string>("Image_Path"),
Company = xe.Value<string>("Company"),
Description = xe.Value<string>("Description"),
Version = xe.Value<Version>("Version"),
User = xe.Value<string>("User"),
Authentication_ID = xe.Value<string>("Authentication_ID"),
Session = xe.Value<string>("Session"),
Command_Line = xe.Value<string>("Command_Line"),
TID = xe.Value<int>("TID"),
Virtualized = xe.Value<bool>("Virtualized"),
Integrity = xe.Value<string>("Integrity"),
Category = xe.Value<string>("Category"),
Parent_PID = xe.Value<int>("Parent_PID"),
Architecture = xe.Value<string>("Architecture")
};
return pmEvent;
}
