private MailboxAuditLogRecord ReadAuditLogRecord(ObjectId itemId, ExDateTime creationTime, string content)
{
MailboxAuditLogRecordId identity = new MailboxAuditLogRecordId(itemId);
string mailboxResolvedName = MailboxAuditLogSearchWorker.ResolveMailboxOwnerName(this.mailboxUser);
MailboxAuditLogEvent mailboxAuditLogEvent = AuditLogParseSerialize.ParseMailboxAuditRecord(identity, content, mailboxResolvedName, this.mailboxUser.Guid.ToString(), new DateTime?(creationTime.UniversalTime.ToLocalTime()));
this.ResolveDisplayNames(mailboxAuditLogEvent);
return(mailboxAuditLogEvent);
}
private MailboxAuditLogRecord CompareLastAccessDatesAndPrepareUserRecord(List <string> logonTypes)
{
new List <MailboxAuditLogRecord>();
ExDateTime endDate = new ExDateTime(ExTimeZone.UtcTimeZone, this.searchCriteria.EndDateUtc.Value);
ExDateTime startDate = new ExDateTime(ExTimeZone.UtcTimeZone, this.searchCriteria.StartDateUtc.Value);
DateTime? lastAccessed = MailboxAuditLogSearchWorker.CompareLastAccessWithSearchCriteria(this.mailboxUser, startDate, endDate, logonTypes);
if (lastAccessed != null)
{
MailboxAuditLogRecordId identity = new MailboxAuditLogRecordId(this.mailboxUser.Identity);
string mailboxResolvedName = MailboxAuditLogSearchWorker.ResolveMailboxOwnerName(this.mailboxUser);
return(new MailboxAuditLogRecord(identity, mailboxResolvedName, this.mailboxUser.Guid.ToString(), lastAccessed));
}
return(null);
}
private static MailboxAuditLogRecord GetLatestAccessDateAndPrepareUserRecord(ADUser user, string logonType)
{
DateTime?lastAccessed = null;
if (logonType.Equals("External", StringComparison.OrdinalIgnoreCase))
{
DateTime?dateTime = (DateTime?)user[ADRecipientSchema.AuditLastExternalAccess];
if (dateTime != null)
{
lastAccessed = dateTime;
}
}
else if (logonType.Equals("Admin", StringComparison.OrdinalIgnoreCase))
{
DateTime?dateTime2 = (DateTime?)user[ADRecipientSchema.AuditLastAdminAccess];
if (dateTime2 != null)
{
lastAccessed = dateTime2;
}
}
else if (logonType.Equals("Delegate", StringComparison.OrdinalIgnoreCase))
{
DateTime?dateTime3 = (DateTime?)user[ADRecipientSchema.AuditLastDelegateAccess];
if (dateTime3 != null)
{
lastAccessed = dateTime3;
}
}
if (lastAccessed != null)
{
MailboxAuditLogRecordId identity = new MailboxAuditLogRecordId(user.Identity);
string mailboxResolvedName = MailboxAuditLogSearchWorker.ResolveMailboxOwnerName(user);
return(new MailboxAuditLogRecord(identity, mailboxResolvedName, user.Guid.ToString(), lastAccessed));
}
return(null);
}
public static MailboxAuditLogEvent ParseMailboxAuditRecord(MailboxAuditLogRecordId identity, string eventLog, string mailboxResolvedName, string guid, DateTime?lastAccessed)
{
MailboxAuditLogEvent mailboxAuditLogEvent = new MailboxAuditLogEvent(identity, mailboxResolvedName, guid, lastAccessed);
using (StringReader stringReader = new StringReader(eventLog))
{
PropertyParseSchema[] array = AuditLogParseSerialize.MailboxAuditLogRecordParseSchema;
string[] array2 = new string[2];
string text;
while ((text = stringReader.ReadLine()) != null)
{
if (text.Contains(".SourceItemId"))
{
MultiValuedProperty <MailboxAuditLogSourceItem> multiValuedProperty = mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceItems] as MultiValuedProperty <MailboxAuditLogSourceItem>;
string itemId = text.Substring(text.IndexOf(":") + 1).Trim();
if ((text = stringReader.ReadLine()) == null)
{
MailboxAuditLogSourceItem item = MailboxAuditLogSourceItem.Parse(itemId, null, null);
multiValuedProperty.Add(item);
break;
}
array2[0] = text;
text = stringReader.ReadLine();
array2[1] = text;
string itemSubject = null;
string itemFolderPathName = null;
foreach (string text2 in array2)
{
if (text2 == null)
{
break;
}
if (text2.Contains(".SourceItemSubject"))
{
itemSubject = text2.Substring(text2.IndexOf(":") + 1).Trim();
}
if (text2.Contains(".SourceItemFolderPathName"))
{
itemFolderPathName = text2.Substring(text2.IndexOf(":") + 1).Trim();
}
}
MailboxAuditLogSourceItem item2 = MailboxAuditLogSourceItem.Parse(itemId, itemSubject, itemFolderPathName);
((MultiValuedProperty <MailboxAuditLogSourceItem>)mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceItems]).Add(item2);
if (text == null)
{
break;
}
}
else if (text.Contains(".SourceFolderId"))
{
MultiValuedProperty <MailboxAuditLogSourceFolder> multiValuedProperty2 = mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceFolders] as MultiValuedProperty <MailboxAuditLogSourceFolder>;
string folderId = text.Substring(text.IndexOf(":") + 1).Trim();
if ((text = stringReader.ReadLine()) == null)
{
MailboxAuditLogSourceFolder item3 = MailboxAuditLogSourceFolder.Parse(folderId, null);
multiValuedProperty2.Add(item3);
break;
}
string folderPathName = text.Substring(text.IndexOf(":") + 1).Trim();
MailboxAuditLogSourceFolder item4 = MailboxAuditLogSourceFolder.Parse(folderId, folderPathName);
multiValuedProperty2.Add(item4);
}
else
{
PropertyParseSchema[] array4 = array;
int j = 0;
while (j < array4.Length)
{
PropertyParseSchema propertyParseSchema = array4[j];
if (text.StartsWith(propertyParseSchema.Label, StringComparison.OrdinalIgnoreCase) && text[propertyParseSchema.Label.Length] == ':')
{
object obj = propertyParseSchema.PropertyParser(text.Substring(propertyParseSchema.Label.Length + 1).Trim());
if (obj != null)
{
mailboxAuditLogEvent[propertyParseSchema.Property] = obj;
break;
}
break;
}
else
{
j++;
}
}
}
}
}
return(mailboxAuditLogEvent);
}
