c# - 如何将 .evtx 事件日志转换为 csv

Question

我的 Windows 服务需要将一个事件日志的内容保存到一个文件中。这是由 EventLogSession.ClearLog 完成的。但是，我不能强制它直接将事件日志保存到 CSV。保存的格式为 EVTX。

            EventLogSession els = new EventLogSession();

            //stel de filename samen door het appdata pad te combinen met een tempfile name
            string tempData = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "templog.csv");
            // Clears all the events and archives them to the .evtx file

            els.ClearLog(eventLogName, tempData); //  Backup File Path

我如何强制 EventlogSession 类直接保存到 CSV，或者，如果那是不可能的。如何将 EVTX 转换为 CSV（使用 C# 或 VB.net）

谢谢！

score 5 · Accepted Answer

使用 Log Parser 提供的 API 很容易做到这一点。

下载并安装日志解析器 2.2

添加对 COM 库“MS Utility 1.0 类型库 - LogParser 接口集合”的引用。搜索 Log 大大缩小了列表的范围。

在此处输入图像描述

更改引用的属性，使其不嵌入互操作类型。如果你不这样做，你会得到这样的编译错误：Interop type 'MSUtil.COMCSVOutputContextClassClass' cannot be embedded。请改用适用的接口。

MSUtil 互操作类型

LogParser 帮助文件的内容对 API 有很好的参考，但我已将我使用的部分包含在代码中。

using System;
using MSUtil;

namespace LogParserTest
{
 using LogQuery = LogQueryClassClass;
 using EventLogInput = COMEventLogInputContextClassClass;
 using CSVOutput = COMCSVOutputContextClassClass;
 using XMLOutput = COMXMLOutputContextClassClass;

 class Program
 {
  static void Main(string[] args)
  {
   try
   {
    // Instantiate the LogQuery object
    LogQuery oLogQuery = new LogQuery();

    // Instantiate the Event Log Input Format object
    EventLogInput eventInputFormat = new EventLogInput();

    // When set to "FW", events are retrieved from the oldest to the 
    // newest. When set to "BW", events are retrieved from the newest 
    // to the oldest.
    eventInputFormat.direction = "FW"; 

    // Event text messages often span multiple lines. When this parameter
    // is set to "ON", the EVT input format preserves readability of the 
    // messages by removing carriage-return, line-feed, and multiple space
    // characters from the message text.
    // When this parameter is set to "OFF", the EVT input format returns
    // the original message text with no intervening post-processing. 
    eventInputFormat.formatMessage = true;

    eventInputFormat.binaryFormat = "ASC";
    eventInputFormat.stringsSep = ",";

    CSVOutput csvOutputFormat = new CSVOutput();

    // ON: always write the header; 
    // OFF: never write the header; 
    // AUTO: write the header only when not appending to an existing file. 
    csvOutputFormat.headers = "ON"; 

    // Setting this parameter to "ON" causes the CSV output format to write
    // a tab character after each comma field separator, in order to 
    // improve readability of the CSV output. Note that using tabs between
    // field values might generate output that is not compatible with 
    // certain spreadsheet applications. 
    csvOutputFormat.tabs = false;

    // ON: always enclose field values within double-quote characters; 
    // OFF: never enclose field values within double-quote characters; 
    // AUTO: enclose within double-quote characters only those field 
    //    values that contain comma (,) characters. 
    csvOutputFormat.oDQuotes = "AUTO";

    // This parameter specifies the date and/or time format to use when
    // formatting values of the TIMESTAMP data type.
    csvOutputFormat.oTsFormat = "yyyy-MM-dd";

    // 0 is the system codepage, -1 is UNICODE. 
    csvOutputFormat.oCodepage = -1;

    // 0: existing files are appended with the output; 
    // 1: existing files are overwritten with the output; 
    // 2: existing files are left intact, discarding the output. 
    csvOutputFormat.fileMode = 1;

    /*
    EventLog     STRING  Name of the Event Log or Event Log backup file 
    RecordNumber   INTEGER  Index of this event
    TimeGenerated   TIMESTAMP Event generated date/time (local time) 
    TimeWritten    TIMESTAMP Event logged date/time (local time) 
    EventID      INTEGER  The ID of the event 
    EventType     INTEGER  The numeric type of the event 
    EventTypeName   STRING  The descriptive type of the event 
    EventCategory   INTEGER  The numeric category of the event 
    EventCategoryName STRING  The descriptive category of the event 
    SourceName    STRING  The source that generated the event 
    Strings      STRING  The textual data
    ComputerName   STRING  The name of the computer  
    SID        STRING  The Security Identifier associated with the event 
    Message      STRING  The full event message 
    Data       STRING  The binary data associated with the event 
    */

    string query = @"SELECT TOP 10 EventLog, RecordNumber, Message INTO "
    // Enclose path in single ticks to handle spaces.
    query += "'" + FullPathToCsv + "' FROM "; 
    // Name of application Log, System, Security, Application, CustomLogName
    query += "System";     
    oLogQuery.ExecuteBatch(query, eventInputFormat, csvOutputFormat);
   }
   catch (System.Runtime.InteropServices.COMException ex)
   {
    Console.WriteLine("Unexpected error: " + ex.Message);
   }
  }
 }
}

score 4 · Accepted Answer

这个 Powershell 函数是我能找到的最有效的。不是 C# 代码，但我认为它可能有用。它需要一个文件名 (evtx) 或 Powershell 中的文件名变量数组，如下所示：

[数组]$filelist = "file1", "file2", "file3"

Function Convert-Logs3 {
[cmdletbinding()]
Param(
$filelist=$NULL
)
$filelist | foreach-object {
Get-WinEvent -Path "$PSItem"| Select RecordID,ID,TimeCreated, Message | export-csv - ``notypeinformation -path $(write "$PSItem.csv");
[System.gc]::collect();

}}

score 2 · Accepted Answer

事实证明，所有现有的解决方案都不符合我的要求。我只是想要一个将 evtx 作为输入并导出 csv 的工具。不多不少。我自己建了一个，效果很好。它被称为 EVTX2CSV

您可以在这里下载：http ://essaver.net/evtxecsv或直接通过http://www.essaver.net/downloads/setupevtx2csv.exe

score 2 · Accepted Answer

如果你只是想要一个将 EVTX 转换为 CSV 的工具，你可以直接使用 LogParser 工具：

C:\> logparser "SELECT TimeGenerated, SourceName, EventCategoryName, EventId, Message INTO C:\eventlog.csv FROM C:\eventlog.evtx" -i:EVT

我能够使用它在大约 10 分钟内将 3 GB EVTX 文件转换为 CSV。

c# - 如何将 .evtx 事件日志转换为 csv

4 回答 4

Related

Reference