private void btnAudit_Click(object sender, EventArgs e) { this.Cursor = Cursors.WaitCursor; try { SetControlEnabled(false); List <LogFilterCondition> lstConditions = new List <LogFilterCondition>(); LogFilterCondition condition = null; // 检查过滤条件是否完整 #region 检查过滤条件是否完整 List <OperateParam> lstParams = new List <OperateParam>(); int rowIndex = 0; foreach (DataGridViewRow dgvr in this.dgvConditions.Rows) { rowIndex++; if (Convert.ToBoolean(dgvr.Cells[SelectColumnIndex].Value)) { lstParams.Clear(); LogColumn lc = LogColumnService.Instance.GetLogColumn(Convert.ToInt32(dgvr.Tag)); IColumnType colType = TableColumnTypeService.Instance.GetColumnType(lc.Type); IRelation relation = RelationService.Instance.GetRelation(lc.Type, Convert.ToString(dgvr.Cells[RelationColumnIndex].Value)); // 目前仅支持与一个值比较或者两个值比较 // 这里还可以改的更通用一些,把if去掉 if (relation.ParamsCount == 1) { string value = Convert.ToString(dgvr.Cells[ContentColumnIndex].Value); if (!colType.Validate(value)) { dgvr.Cells[ContentColumnIndex].Selected = true; throw new Exception(string.Format("行{0}的值有误,不符合类型“{1}”的格式要求", rowIndex, lc.Type)); } lstParams.Add(new OperateParam(value)); if (!relation.Validate(lstParams)) { dgvr.Cells[ContentColumnIndex].Selected = true; throw new Exception(string.Format("行{0}的值有误,不符合关系“{1}”的格式要求", rowIndex, relation.Group)); } condition = new LogFilterCondition(lc.Index, lc.Type); condition.Content = Convert.ToString(dgvr.Cells[ContentColumnIndex].Value); condition.Relation = relation.Name; lstConditions.Add(condition); } else if (relation.ParamsCount == 2) { string leftValue = Convert.ToString(dgvr.Cells[StartDateColumnIndex].Value); if (!colType.Validate(leftValue)) { dgvr.Cells[StartDateColumnIndex].Selected = true; throw new Exception(string.Format("行{0}的值有误,不符合类型“{1}”的格式要求", rowIndex, lc.Type)); } string rightValue = Convert.ToString(dgvr.Cells[EndDateColumnIndex].Value); if (!colType.Validate(rightValue)) { dgvr.Cells[EndDateColumnIndex].Selected = true; throw new Exception(string.Format("行{0}的值有误,不符合类型“{1}”的格式要求", rowIndex, lc.Type)); } lstParams.Add(new OperateParam(leftValue)); lstParams.Add(new OperateParam(rightValue)); if (!relation.Validate(lstParams)) { dgvr.Cells[StartDateColumnIndex].Selected = true; throw new Exception(string.Format("行{0}的值有误,不符合关系“{1}”的格式要求", rowIndex, relation.Group)); } condition = new LogFilterCondition(lc.Index, lc.Type); condition.LeftBound = leftValue; condition.RightBound = rightValue; condition.Relation = relation.Name; lstConditions.Add(condition); } } } #endregion #region 开始检索日志 foreach (LogShowTabPage page in m_tabPages.Values) { if (page.Parent == null) { continue; } string tableGuid = Convert.ToString(page.TableGuid); List <LogRecord> lstRecords = LogContentService.Instance.GetAppLogs(m_app.AppGUID, tableGuid, lstConditions); page.SetLogs(lstRecords); } #endregion } catch (Exception ex) { MessageBox.Show(string.Format("检索{0}的日志时出错,错误消息为:{1}", m_app.Name, ex.Message)); } finally { this.Cursor = Cursors.Default; SetControlEnabled(true); } }
public override void Execute(LogRecord record, ILogColumnService colSrv) { try { m_result.Clear(); List <OperateParam> lstParams = new List <OperateParam>(); foreach (SecurityEvent se in m_events) { foreach (SecurityAction sa in se.SecurityActions) { if (sa.Conditions.Count <= 0) { continue; } bool result = true; // 先检查是否满足关系要求 foreach (SecurityCondition condition in sa.Conditions) { if (!record.Items.ContainsKey(condition.SourceCol)) { result = false; break; } lstParams.Clear(); IRelation relation = RelationService.Instance.GetRelation(colSrv.GetLogColumn(condition.SourceCol).Type, condition.RelationName); if (condition.IsUsingDestCol) { foreach (string s in condition.MultiValues) { int colIndex = Convert.ToInt32(s); if (!record.Items.ContainsKey(colIndex)) { result = false; goto NextAction; } lstParams.Add(new OperateParam(record.Items[colIndex].Conetent)); } } else { foreach (string s in condition.MultiValues) { lstParams.Add(new OperateParam(s)); } } // 检测是否满足关系 if (!relation.Validate(lstParams)) { result = false; } else { lstParams.Insert(0, new OperateParam(record.Items[condition.SourceCol].Conetent)); result = result && relation.Implement(lstParams); } if (!result) { break; } } NextAction: // 如果符合结果 if (result) { EvaluateResult er = new EvaluateResult(record.RecordGuid); er.AppGuid = record.AppGuid; er.TableGuid = record.TableGuid; er.ActionName = sa.Name; er.ActionGuid = sa.ActionGuid; er.EventName = se.Name; er.EventGuid = se.EventGuid; er.ResultGuid = sa.ResultGuid; m_result.Add(er); } } } } catch (Exception ex) { throw new Exception("根据策略分析日志记录失败,错误消息为:" + ex.Message); } }