使用 win32evtlog Python 打开特定事件日志

Question

我想在 Windows 事件日志中打开一个名为“Microsoft-Windows-TerminalServices-LocalSessionManager”的特定日志。我使用了这段代码：

import win32evtlog

server = 'localhost' # name of the target computer to get event logs
logtype = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System\Microsoft-Windows-TerminalServices-LocalSessionManager'
hand = win32evtlog.OpenEventLog(server,logtype)
flags =  win32evtlog.EVENTLOG_SEQUENTIAL_READ|win32evtlog.EVENTLOG_FORWARDS_READ
total = win32evtlog.GetNumberOfEventLogRecords(hand)

while True:
    events = win32evtlog.ReadEventLog(hand, flags,0)
    if events:
        for event in events:
                print('Event Category:', event.EventCategory)
                print ('Time Generated:', event.TimeGenerated)
                print ('Source Name:', event.SourceName)
                print ('Event ID:', event.EventID)
                print ('Event Type:', event.EventType)
                data = event.StringInserts
                if data:
                    print('Event Data:')
                    for msg in data:
                        print(msg)

但它不起作用，此代码打开“系统”日志，而不是“Microsoft-Windows-TerminalServices-LocalSessionManager”。 为什么它不起作用？如果不是bug，而是特性，那么读取这个日志的方法是什么？

感谢您的回答

Answer 1

您只能使用一级子键，如Application、HardwareEvents、Internet Explorer、System 等。

sourceName 指定返回的句柄将引用的源名称。源名称必须是注册表中 EventLog 项下的日志文件条目的子项。 win32evtlog.OpenEventLog

如果您指定了自定义日志，但找不到，则事件日志服务打开应用程序日志；但是，不会有关联的消息或类别字符串文件。 OpenEventLogA function (winbase.h)

但是您可以使用win32evtlog.EvtQuery 函数来获取事件。

注意：如果遇到Access Denied 错误，请尝试使用Run as Administrator 运行

import win32evtlog
import xml.etree.ElementTree as ET

# open event file
query_handle = win32evtlog.EvtQuery(
    'C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx',
    win32evtlog.EvtQueryFilePath)

read_count = 0
while True:
    # read 100 records
    events = win32evtlog.EvtNext(query_handle, 100)
    read_count += len(events)
    # if there is no record break the loop
    if len(events) == 0:
        break
    for event in events:
        xml_content = win32evtlog.EvtRender(event, win32evtlog.EvtRenderEventXml)
        # print(xml_content)

        # parse xml content
        xml = ET.fromstring(xml_content)
        # xml namespace, root element has a xmlns definition, so we have to use the namespace
        ns = '{http://schemas.microsoft.com/win/2004/08/events/event}'

        event_id = xml.find(f'.//{ns}EventID').text
        level = xml.find(f'.//{ns}Level').text
        channel = xml.find(f'.//{ns}Channel').text
        execution = xml.find(f'.//{ns}Execution')
        process_id = execution.get('ProcessID')
        thread_id = execution.get('ThreadID')
        time_created = xml.find(f'.//{ns}TimeCreated').get('SystemTime')
        print(f'Time: {time_created}, Level: {level} Event Id: {event_id}, Channel: {channel}, Process Id: {process_id}, Thread Id: {thread_id}')
        
        user_data = xml.find(f'.//{ns}UserData')
        # user_data has possible any data
        
print(f'Read {read_count} records')

输出：

Time: 2020-12-20T10:47:53.3790439Z, Level: 4 Event Id: 32, Channel: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational, Process Id: 1476, Thread Id: 1496
Time: 2020-12-20T10:47:57.5636553Z, Level: 4 Event Id: 41, Channel: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational, Process Id: 1476, Thread Id: 1504
Time: 2020-12-20T10:47:57.5662431Z, Level: 4 Event Id: 42, Channel: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational, Process Id: 1476, Thread Id: 1504
Time: 2020-12-20T10:48:26.9395585Z, Level: 4 Event Id: 21, Channel: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational, Process Id: 1476, Thread Id: 1512
Time: 2020-12-20T10:48:27.0466986Z, Level: 4 Event Id: 22, Channel: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational, Process Id: 1476, Thread Id: 10212
Read 823 records