diff --git a/samples/event_log/evtexplorer.py b/samples/event_log/evtexplorer.py new file mode 100644 index 0000000..35b785a --- /dev/null +++ b/samples/event_log/evtexplorer.py @@ -0,0 +1,90 @@ +import sys +import windows + +# target = int(sys.argv[1]) + +import argparse + +parser = argparse.ArgumentParser(prog=__file__, formatter_class=argparse.ArgumentDefaultsHelpFormatter) + +parser.add_argument('--channel', nargs=1) +parser.add_argument('--publisher', nargs=1) +parser.add_argument('--verbose', action="store_true") +parser.add_argument('--evtdata', action="store_true") +parser.add_argument('--list-channels', action="store_true") +parser.add_argument('--list-publishers', action="store_true") +parser.add_argument('evtid', nargs="?", type=int) +args = parser.parse_args() +print(args) + +for publisher in windows.system.event_log.publishers: + if args.publisher and args.publisher[0] not in publisher.name: + continue + + if args.list_publishers: + print(publisher) + continue + + try: + channels = publisher.metadata.channel_name_by_id + except WindowsError as e: + if args.verbose: + print(publisher, e) + continue + + + + if args.list_channels: + publisher_printed = False + for chan in channels.values(): + if args.channel and args.channel[0] not in chan: + continue + if not publisher_printed: + print(publisher) + publisher_printed = True + print(" * {0}".format(chan)) + continue + + + if args.channel: + channels = {k:v for k,v in channels.items() if args.channel[0] in v} + + try: + eventsmeta = publisher.metadata.events_metadata + except WindowsError as e: + if args.verbose: + print(publisher, e) + continue + + match_events = {k: [] for k in channels} + match_events[0] = [] + try: + for eventmeta in eventsmeta: + if args.evtid and args.evtid != eventmeta.id: + continue + if eventmeta.channel_id in match_events: + match_events[eventmeta.channel_id].append(eventmeta) + except WindowsError as e: + if args.verbose: + print(publisher, e) + continue + + for channel_id in match_events: + # if args.channel: print channel anyway + if (not args.channel) and not match_events[channel_id]: + continue + if channel_id == 0: + print(" of {0}".format(publisher)) + else: + print(channels[channel_id]) + for eventsmeta in match_events[channel_id]: + try: + msg = publisher.metadata.message(eventsmeta.message_id) + except WindowsError as e: + msg = "" + + print(" * {0} <{1!r}>".format(eventsmeta.id, msg)) + if args.evtdata: + for evtdata in eventsmeta.event_data: + print(" * {0} ({1})".format(evtdata["name"], evtdata["outType"])) +