private log_entry_line line_from_reader() { log_entry_line row = new log_entry_line(); int i = 0; try { for (; i < mappings_.Count; ++i) { bool is_time_ = mappings_[i].Item2 == info_type.time; if (is_time_) { if (read_time_as_string_) row.add_time(reader_.GetString(i)); else { // read time column as datetime try { // if this throws, read it as string row.add_time(reader_.GetDateTime(i)); } catch (Exception e) { logger.Error("can't read time column as datetime (will try reading as string) :" + e.Message); read_time_as_string_ = true; --i; } } if (settings.db_id_field == "") // sorting, for when we'll need to do tailing last_time_str_ = reader_.GetString(i); } else // non-time column // FIXME perhaps I could speed this up - perhaps I might even be able to create a 'line' object directly. But for now, lets leave it like this row.add(mappings_[i].Item1, reader_.GetString(i)); } if (settings.db_id_field != "") last_id_ = reader_.GetInt64(mappings_.Count); } catch (Exception ee) { logger.Error("can't read db row " + ee.Message); errors_.add("Cannot read db field " + mappings_[i].Item1 + " : " + ee.Message); continue_reading_ = false; } // update last_id and time return row; }
private log_entry_line to_log_entry(EventRecord rec, string log_name) { log_entry_line entry = new log_entry_line(); try { entry.add("Log", log_name); entry.add("EventID", "" + rec.Id); entry.add("level", event_level((StandardEventLevel) rec.Level)); entry.add_time(rec.TimeCreated.Value); try { var task = rec.Task != 0 ? rec.TaskDisplayName : ""; entry.add("Category", task ?? ""); } catch { entry.add("Category", ""); } entry.add("Machine Name", rec.MachineName); entry.add("Source", "" + rec.ProviderName); string user_id = rec.UserId != null ? rec.UserId.Value : ""; if (user_id != "") user_id = new SecurityIdentifier(user_id).Translate(typeof(NTAccount)).ToString();; entry.add("User Name", user_id); /* 1.5.14+ this generates waaaay too many errors - just ignore for now try { var keywords = rec.KeywordsDisplayNames; entry.add("Keywords", keywords != null ? util.concatenate(keywords, ",") : ""); } catch { entry.add("Keywords", ""); }*/ // note: this throws a lot of exceptions; however, we don't have much of a choice here - just showing the raw properties is rather useless try { var desc = rec.FormatDescription(); if ( desc == null) desc = util.concatenate( rec.Properties.Select(x => x.Value.ToString()), "\r\n"); entry.add("msg", desc ?? ""); } catch { try { string desc = util.concatenate( rec.Properties.Select(x => x.Value.ToString()), "\r\n"); entry.add("msg", desc); } catch { entry.add("msg", ""); } } } catch (Exception e) { logger.Fatal("can't convert EventRectord to entry " + e.Message); } return entry; }