mirror of
https://github.com/eronnen/procmon-parser
synced 2026-06-08 14:05:59 +00:00
eronnen
71 lines
2.4 KiB
Python
71 lines
2.4 KiB
Python
from six import PY2
|
|
|
|
from procmon_parser.configuration import *
|
|
from procmon_parser.configuration_format import load_configuration, loads_configuration, dump_configuration, \
|
|
dumps_configuration
|
|
from procmon_parser.logs import *
|
|
from procmon_parser.stream_logs_format import PMLStreamReader
|
|
|
|
__all__ = [
|
|
'ProcmonLogsReader', 'load_configuration', 'loads_configuration', 'dump_configuration', 'dumps_configuration',
|
|
'Rule', 'Column', 'RuleAction', 'RuleRelation', 'PMLError'
|
|
]
|
|
|
|
|
|
class ProcmonLogsReader(object):
|
|
"""Reads procmon logs from a stream which in the PML format
|
|
"""
|
|
|
|
def __init__(self, f, should_get_stacktrace=True, should_get_details=True):
|
|
"""Build a ProcmonLogsReader object from ``f`` (a `.read()``-supporting file-like object).
|
|
:param f: ``read`` supporting file-like object
|
|
:param should_get_stacktrace: True if the parser should parse the stack traces
|
|
:param should_get_details: True if the parser should parse the Detail column information of the event.
|
|
"""
|
|
self._struct_readear = PMLStreamReader(f, should_get_stacktrace, should_get_details)
|
|
self._current_event_index = 0
|
|
|
|
def __iter__(self):
|
|
return self
|
|
|
|
def __next__(self):
|
|
if self._current_event_index >= self.__len__():
|
|
raise StopIteration
|
|
current_index = self._current_event_index
|
|
self._current_event_index += 1
|
|
return self[current_index]
|
|
|
|
if PY2:
|
|
next = __next__
|
|
|
|
def __getitem__(self, index):
|
|
return self._struct_readear[index]
|
|
|
|
def __len__(self):
|
|
return self._struct_readear.number_of_events
|
|
|
|
def processes(self):
|
|
"""Return a list of all the known processes in the log file
|
|
"""
|
|
return self._struct_readear.processes()
|
|
|
|
def system_details(self):
|
|
"""Return the system details of the computer which captured the logs (like Tools -> System Details in Procmon)
|
|
"""
|
|
return self._struct_readear.system_details()
|
|
|
|
|
|
def read_all_events_from_pml(file):
|
|
"""
|
|
Helper function that reads all the events from a PML file.
|
|
:param file: the path to the PML file or an open file object.
|
|
:return: a list of Event objects from the file.
|
|
"""
|
|
if not hasattr(file, 'read'):
|
|
with open(file, "rb") as f:
|
|
pml_reader = PMLStreamReader(f)
|
|
return list(pml_reader)
|
|
else:
|
|
pml_reader = PMLStreamReader(file)
|
|
return list(pml_reader)
|