public static ApplicationError ParseEntry(EventRecord eventRecord)
{
try
{
var iisIdRegex = new Regex(@"/LM/W3SVC/(\d{1,9}).+", RegexOptions.IgnoreCase | RegexOptions.Compiled);
// Entries kan forekomme uden et IIS id.
var iisIdString = eventRecord.Properties[8].Value.ToString();
var iisIdMatch = iisIdRegex.Match(iisIdString);
var iisIdResult = (iisIdMatch.Groups.Count > 1 && !string.IsNullOrEmpty(iisIdMatch.Groups[1].Value)) ? Convert.ToInt32(iisIdMatch.Groups[1].Value) : 0;
if (iisIdResult == 0)
return null;
var fullMessage = eventRecord.Properties[18].Value.ToString();
var error = new ApplicationError
{
Id = (int)eventRecord.RecordId,
SiteIisId = iisIdResult,
DateTime = eventRecord.TimeCreated.Value.ToUniversalTime(),
ExceptionType = eventRecord.Properties[17].Value.ToString(),
Message = eventRecord.Properties[1].Value.ToString(),
FullMessage = fullMessage.Replace(Environment.NewLine, "<br />").Trim(),
ThreadInformation = eventRecord.Properties[29].Value.ToString().Replace(Environment.NewLine, "<br />").Trim(),
Url = eventRecord.Properties[19].Value.ToString(),
ClientIpAddress = eventRecord.Properties[21].Value.ToString()
};
var indexOfBreak = fullMessage.IndexOf("\n ", System.StringComparison.InvariantCulture);
var description = fullMessage.Substring(0, indexOfBreak);
error.Description = description;
return error;
}
catch (Exception ex)
{
EventLog.WriteEntry("Servant for IIS", "Error parsing entry: " + ex.Message + Environment.NewLine + ex.StackTrace + Environment.NewLine + Environment.NewLine + Environment.NewLine + "EventRecord: " + Environment.NewLine + eventRecord.ToXml());
return null;
}
}
public dynamic CreateDynamic(EventRecord record)
{
var obj = new ExpandoObject();
IDictionary<string, object> underObject = obj;
underObject["Source"] = "WindowsEventLog";
underObject["Devicename"] = record.MachineName.ToUpper();
underObject["EventTime"] = record.TimeCreated.Value.ToUniversalTime().ToString("o");
underObject["EventId"] = record.Id.ToString();
underObject["Level"] = record.Level.HasValue ? ((int)record.Level.Value).ToString() : string.Empty;
underObject["User"] = record.UserId != null ? record.UserId.Translate(typeof(NTAccount)).ToString() : "N/A";
underObject["ProviderName"] = record.ProviderName;
// if SQL Audit Event
if (record.Id == 33205)
{
var entries = record.FormatDescription().Replace("Audit event: ", "").Split(new[] {'\n'});
foreach (var entry in entries)
{
var colon = entry.IndexOf(':');
if (colon != -1)
{
underObject.Add(entry.Substring(0, colon), entry.Substring(colon + 1, entry.Length - colon - 1));
}
}
}
else
{
underObject["Description"] = record.FormatDescription();
var root = XElement.Parse(record.ToXml());
XNamespace x = "http://schemas.microsoft.com/win/2004/08/events/event";
var dataNodes = root.Descendants(x + "Data")
.Where(e => e.HasAttributes && e.Attributes().Any(a => a.Name == "Name"));
foreach (var node in dataNodes)
{
var key = node.Attributes().First(a => a.Name == "Name").Value;
if (!underObject.ContainsKey(key))
{
underObject.Add(key, node.Value);
}
}
}
return underObject;
}