1c/YY.EventLogReaderAssistant
1
0
Fork 0
mirror of https://github.com/BDDSM/YY.EventLogReaderAssistant.git synced 2024-11-26 18:11:45 +02:00
Code Issues Releases Activity

Рефакторинг основных классов приложения

Browse Source
This commit is contained in:
YPermitin 2020-04-11 13:14:43 +05:00
parent ad5155067e
commit d67744785f
6 changed files with 595 additions and 619 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
YY.EventLogAssistant/YY.EventLogAssistant/EventLogLGDReader.cs
View File

@ -9,6 +9,8 @@ namespace YY.EventLogAssistant
{
internal sealed class EventLogLGDReader : EventLogReader
{
#region Private Member Variables
private string _connectionString;
private string ConnectionString
{
@ -26,7 +28,11 @@ namespace YY.EventLogAssistant
private long _lastRowNumberFromBuffer;
private long _eventCount = -1;
internal EventLogLGDReader() : base() { }
#endregion
#region Constructor
internal EventLogLGDReader() : base() { }
internal EventLogLGDReader(string logFilePath) : base(logFilePath)
{
_readBuffer = new List<RowData>();
@ -34,6 +40,10 @@ namespace YY.EventLogAssistant
_lastRowNumberFromBuffer = 0;
}
#endregion
#region Public Methods
public override bool Read()
{
try
@ -159,7 +169,6 @@ namespace YY.EventLogAssistant
return false;
}
}
public override bool GoToEvent(long eventNumber)
{
Reset();
@ -196,7 +205,6 @@ namespace YY.EventLogAssistant
return false;
}
public override EventLogPosition GetCurrentPosition()
{
return new EventLogPosition(
@ -205,7 +213,6 @@ namespace YY.EventLogAssistant
_logFilePath,
null);
}
public override void SetCurrentPosition(EventLogPosition newPosition)
{
if (newPosition.CurrentFileReferences != _logFilePath)
@ -216,7 +223,6 @@ namespace YY.EventLogAssistant
GoToEvent(newPosition.EventNumber);
}
public override long Count()
{
if (_eventCount < 0)
@ -244,7 +250,6 @@ namespace YY.EventLogAssistant
return _eventCount;
}
public override void Reset()
{
System.Data.SQLite.SQLiteConnection.ClearAllPools();
@ -257,7 +262,6 @@ namespace YY.EventLogAssistant
_lastRowNumberFromBuffer = 0;
_readBuffer.Clear();
}
public override void Dispose()
{
base.Dispose();
@ -270,6 +274,10 @@ namespace YY.EventLogAssistant
_readBuffer.Clear();
}
#endregion
#region Private Methods
protected override void ReadEventLogReferences()
{
using (_connection = new SQLiteConnection(ConnectionString))
@ -383,5 +391,7 @@ namespace YY.EventLogAssistant
}
}
}
#endregion
}
}

416
YY.EventLogAssistant/YY.EventLogAssistant/EventLogLGFReader.cs
View File

@ -1,10 +1,8 @@
using System;
using System.Collections.Generic;
using System.Globalization;
using System.IO;
using System.Linq;
using System.Text;
using System.Text.RegularExpressions;
using YY.EventLogAssistant.Models;
using YY.EventLogAssistant.Services;
@ -12,29 +10,20 @@ namespace YY.EventLogAssistant
{
internal sealed class EventLogLGFReader : EventLogReader
{
private const long _defaultBeginLineForLGF = 3;
#region Private Member Variables
private const long _defaultBeginLineForLGF = 3;
private int _indexCurrentFile;
private string[] _logFilesWithData;
public string CurrentFile
{
get
{
if (_logFilesWithData.Length <= _indexCurrentFile)
return null;
else
return _logFilesWithData[_indexCurrentFile];
}
}
private long _eventCount = -1;
StreamReader _stream;
StringBuilder _eventSource;
LogParserLGF _logParser;
private LogParserLGF _logParser;
private LogParserLGF LogParser
{
get
get
{
if (_logParser == null)
_logParser = new LogParserLGF(this);
@ -43,6 +32,25 @@ namespace YY.EventLogAssistant
}
}
#endregion
#region Public Properties
public string CurrentFile
{
get
{
if (_logFilesWithData.Length <= _indexCurrentFile)
return null;
else
return _logFilesWithData[_indexCurrentFile];
}
}
#endregion
#region Constructor
internal EventLogLGFReader() : base() { }
internal EventLogLGFReader(string logFilePath) : base(logFilePath)
{
@ -54,6 +62,10 @@ namespace YY.EventLogAssistant
_eventSource = new StringBuilder();
}
#endregion
#region Public Methods
public override bool Read()
{
try
@ -105,7 +117,7 @@ namespace YY.EventLogAssistant
_eventSource.Append(sourceData);
}
if (_logParser.ItsEndOfEvent(sourceData, ref countBracket, ref textBlockOpen))
if (LogParserLGF.ItsEndOfEvent(sourceData, ref countBracket, ref textBlockOpen))
{
newLine = true;
_currentFileEventNumber += 1;
@ -160,7 +172,7 @@ namespace YY.EventLogAssistant
foreach (string line in allLines)
{
currentLineNumber += 1;
if (Regex.IsMatch(line, @"^{\d{4}\d{2}\d{2}\d+"))
if(LogParserLGF.ItsBeginOfEvent(line))
{
currentEventNumber += 1;
}
@ -224,7 +236,7 @@ namespace YY.EventLogAssistant
public override long Count()
{
if(_eventCount < 0)
_eventCount = LogParser.GetEventCount();
_eventCount = GetEventCount();
return _eventCount;
}
@ -264,6 +276,19 @@ namespace YY.EventLogAssistant
}
}
protected override void ReadEventLogReferences()
{
LogParser.ReadEventLogReferences(
_users,
_computers,
_applications,
_events,
_metadata,
_workServers,
_primaryPorts,
_secondaryPorts);
}
public long GetCurrentFileStreamPosition()
{
if (_stream != null)
@ -278,104 +303,9 @@ namespace YY.EventLogAssistant
_stream.SetPosition(position);
}
protected override void ReadEventLogReferences()
{
string Text = string.Empty;
using (FileStream FS = new FileStream(_logFilePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
using (StreamReader SR = new StreamReader(FS))
Text = SR.ReadToEnd();
#endregion
int beginBlockIndex = Text.IndexOf("{");
if (beginBlockIndex < 0)
return;
Text = Text.Substring(beginBlockIndex);
string[] ObjectTexts = LogParser.ParseEventLogString("{" + Text + "}");
string LastProcessedObjectForDebug;
foreach (string TextObject in ObjectTexts)
{
LastProcessedObjectForDebug = TextObject;
string[] a = LogParser.ParseEventLogString(TextObject);
if ((a != null))
{
switch (a[0])
{
case "1":
_users.Add(new Users()
{
Code = long.Parse(a[3]),
Uuid = a[1].ToGuid(),
Name = a[2]
});
break;
case "2":
_computers.Add(new Computers()
{
Code = int.Parse(a[2]),
Name = a[1]
});
break;
case "3":
_applications.Add(new Applications()
{
Code = int.Parse(a[2]),
Name = a[1]
});
break;
case "4":
_events.Add(new Events()
{
Code = int.Parse(a[2]),
Name = a[1]
});
break;
case "5":
_metadata.Add(new Metadata()
{
Code = int.Parse(a[3]),
Uuid = a[1].ToGuid(),
Name = a[2]
});
break;
case "6":
_workServers.Add(new WorkServers()
{
Code = int.Parse(a[2]),
Name = a[1]
});
break;
case "7":
_primaryPorts.Add(new PrimaryPorts()
{
Code = int.Parse(a[2]),
Name = a[1]
});
break;
case "8":
_secondaryPorts.Add(new SecondaryPorts()
{
Code = int.Parse(a[2]),
Name = a[1]
});
break;
//Case "9" - эти значения отсутствуют в файле
//Case "10"
case "11":
break;
case "12":
break;
case "13":
break;
// Последние три значения содержат статус транзакции и важность события
default:
break;
}
}
}
}
#region Private Methods
private void InitializeStream(long linesToSkip, int fileIndex = 0)
{
@ -384,252 +314,26 @@ namespace YY.EventLogAssistant
_stream.SkipLine(linesToSkip);
}
private sealed class LogParserLGF
private long GetEventCount()
{
private EventLogLGFReader _reader;
long eventCount = 0;
public LogParserLGF(EventLogLGFReader reader)
foreach (var logFile in _logFilesWithData)
{
_reader = reader;
using (StreamReader logFileStream = new StreamReader(File.Open(logFile, FileMode.Open, FileAccess.Read, FileShare.ReadWrite)))
{
do
{
string logFileCurrentString = logFileStream.ReadLine();
if(LogParserLGF.ItsBeginOfEvent(logFileCurrentString))
eventCount++;
} while (!logFileStream.EndOfStream);
}
}
public RowData Parse(string eventSource)
{
var parseResult = ParseEventLogString(eventSource);
DateTime eventDate = DateTime.ParseExact(parseResult[0], "yyyyMMddHHmmss", CultureInfo.InvariantCulture);
RowData eventData = new RowData();
eventData.RowID = _reader.CurrentFileEventNumber;
eventData.Period = eventDate;
string TransStr = parseResult[2].ToString().Replace("}", "").Replace("{", "");
long TransDate = TransStr.Substring(0, TransStr.IndexOf(",")).From16To10();
try
{
if (!(TransDate == 0))
eventData.TransactionDate = new System.DateTime().AddSeconds((double)TransDate / 10000);
}
catch
{
eventData.TransactionDate = null;
}
eventData.TransactionId = TransStr.Substring(TransStr.IndexOf(",") + 1).From16To10();
if (parseResult[1] == "R")
eventData.TransactionStatus = TransactionStatus.Unfinished;
else if (parseResult[1] == "N")
eventData.TransactionStatus = TransactionStatus.NotApplicable;
else if (parseResult[1] == "U")
eventData.TransactionStatus = TransactionStatus.Committed;
else if (parseResult[1] == "C")
eventData.TransactionStatus = TransactionStatus.RolledBack;
else
eventData.TransactionStatus = TransactionStatus.Unknown;
eventData.Comment = parseResult[9].RemoveQuotes();
eventData.Session = Convert.ToInt32(parseResult[16]);
eventData.ConnectId = Convert.ToInt32(parseResult[6]);
eventData.DataPresentation = parseResult[12].RemoveQuotes();
eventData.Data = parseResult[11];
MatchCollection matches = Regex.Matches(eventData.Data, @"[\d]+:[\dA-Za-zА-Яа-я]{32}}");
if (matches.Count > 0)
{
string[] dataPartsUUID = eventData.Data.Split(':');
if (dataPartsUUID.Length == 2)
{
string dataUUID = dataPartsUUID[1].Replace("}", string.Empty);
eventData.DataUUID = dataUUID;
}
}
long userID = Convert.ToInt64(parseResult[3]);
eventData.User = _reader.Users.Where(i => i.Code == userID).FirstOrDefault();
long computerID = Convert.ToInt64(parseResult[4]);
eventData.Computer = _reader.Computers.Where(i => i.Code == computerID).FirstOrDefault();
long appID = Convert.ToInt64(parseResult[5]);
eventData.Application = _reader.Applications.Where(i => i.Code == appID).FirstOrDefault();
long eventID = Convert.ToInt64(parseResult[7]);
eventData.Event = _reader.Events.Where(i => i.Code == eventID).FirstOrDefault();
long metadataID = Convert.ToInt64(parseResult[10]);
eventData.Metadata = _reader.Metadata.Where(i => i.Code == metadataID).FirstOrDefault();
long workServerID = Convert.ToInt64(parseResult[13]);
eventData.WorkServer = _reader.WorkServers.Where(i => i.Code == workServerID).FirstOrDefault();
long pimaryPortID = Convert.ToInt64(parseResult[14]);
eventData.PrimaryPort = _reader.PrimaryPorts.Where(i => i.Code == pimaryPortID).FirstOrDefault();
long secondaryPortID = Convert.ToInt64(parseResult[15]);
eventData.SecondaryPort = _reader.SecondaryPorts.Where(i => i.Code == secondaryPortID).FirstOrDefault();
if (eventData.Data == "{\"U\"}") // 'empty reference
eventData.Data = string.Empty;
else if (eventData.Data.StartsWith("{"))
{
//'internal representation for different objects.
var ParsedObject = ParseEventLogString(eventData.Data);
if (ParsedObject.Length == 2)
{
if (ParsedObject[0] == "\"S\"" || ParsedObject[0] == "\"R\"")
{
//'this is string or reference
eventData.Data = ParsedObject[1].RemoveQuotes(); // 'string value
}
}
}
switch (parseResult[8].Trim())
{
case "I":
eventData.Severity = Severity.Information;
break;
case "W":
eventData.Severity = Severity.Warning;
break;
case "E":
eventData.Severity = Severity.Error;
break;
case "N":
eventData.Severity = Severity.Note;
break;
default:
eventData.Severity = Severity.Unknown;
break;
}
return eventData;
}
internal bool ItsEndOfEvent(string Str, ref int Count, ref bool TextBlockOpen)
{
string TempStr = Str;
for (int i = 0; i <= TempStr.Length - 1; i++)
{
string Simb = TempStr.Substring(i, 1);
if (Simb == "\"")
{
TextBlockOpen = !TextBlockOpen;
}
else if (Simb == "}" & !TextBlockOpen)
{
Count = Count - 1;
}
else if (Simb == "{" & !TextBlockOpen)
{
Count = Count + 1;
}
}
return (Count == 0);
}
internal string[] ParseEventLogString(string Text)
{
string[] ArrayLines = null;
string Text2 = Text.Substring(1, (Text.EndsWith(",") ? Text.Length - 3 : Text.Length - 2)) + ",";
string Str = "";
int Delim = Text2.IndexOf(",");
int i = 0;
int partNumber = 0;
bool isSpecialString = false;
while (Delim > 0)
{
Str = Str + Text2.Substring(0, Delim).Trim();
partNumber += 1;
Text2 = Text2.Substring(Delim + 1);
if (partNumber == 1 && !String.IsNullOrEmpty(Str) && Str[0] == '\"')
isSpecialString = true;
int count1;
int count2;
if (isSpecialString)
{
count1 = 0;
count2 = 0;
}
else
{
count1 = CountSubstringInString(Str, "{");
count2 = CountSubstringInString(Str, "}");
}
int count3 = CountSubstringInString(Str, "\"") % 2;//Math.IEEERemainder(CountSubstringInString(Str, "\""), 2);
if (count1 == count2 & count3 == 0)
{
Array.Resize(ref ArrayLines, i + 1);
if (Str.StartsWith("\"") && Str.EndsWith("\""))
{
Str = Str.Substring(1, Str.Length - 2);
}
if (isSpecialString)
{
char[] denied = new[] { '\n', '\t', '\r' };
StringBuilder newString = new StringBuilder();
foreach (var ch in Str)
if (!denied.Contains(ch))
newString.Append(ch);
Str = newString.ToString();
}
ArrayLines[i] = Str;
i = i + 1;
Str = "";
partNumber = 0;
isSpecialString = false;
}
else
{
Str = Str + ",";
}
if (isSpecialString) // Особая обработка для поля "DataPresentation"
{
Delim = Text2.IndexOf("\",") + 1;
}
else
{
Delim = Text2.IndexOf(",");
}
}
return ArrayLines;
}
private int CountSubstringInString(string Str, string SubStr)
{
return (Str.Length - Str.Replace(SubStr, "").Length) / SubStr.Length;
}
public long GetEventCount()
{
long eventCount = 0;
foreach (var logFile in _reader._logFilesWithData)
{
using (StreamReader logFileStream = new StreamReader(File.Open(logFile, FileMode.Open, FileAccess.Read, FileShare.ReadWrite)))
{
do
{
string logFileCurrentString = logFileStream.ReadLine();
if (Regex.IsMatch(logFileCurrentString, @"^{\d{4}\d{2}\d{2}\d+,"))
eventCount++;
} while (!logFileStream.EndOfStream);
}
}
return eventCount;
}
return eventCount;
}
#endregion
}
}

27
YY.EventLogAssistant/YY.EventLogAssistant/EventLogPosition.cs
View File

@ -2,22 +2,25 @@
{
public sealed class EventLogPosition
{
private readonly long _eventNumber;
private readonly string _currentFileReferences;
private readonly string _currentFileData;
private readonly long? _streamPosition;
#region Constructor
public EventLogPosition(long EventNumber, string CurrentFileReferences, string CurrentFileData, long? StreamPosition)
{
_eventNumber = EventNumber;
_currentFileReferences = CurrentFileReferences;
_currentFileData = CurrentFileData;
_streamPosition = StreamPosition;
this.EventNumber = EventNumber;
this.CurrentFileReferences = CurrentFileReferences;
this.CurrentFileData = CurrentFileData;
this.StreamPosition = StreamPosition;
}
public long EventNumber { get { return _eventNumber; } }
public string CurrentFileReferences { get { return _currentFileReferences; } }
public string CurrentFileData { get { return _currentFileData; } }
public long? StreamPosition { get { return _streamPosition; } }
#endregion
#region Public Properties
public long EventNumber { get; }
public string CurrentFileReferences { get; }
public string CurrentFileData { get; }
public long? StreamPosition { get; }
#endregion
}
}

279
YY.EventLogAssistant/YY.EventLogAssistant/EventLogReader.cs
View File

@ -1,12 +1,16 @@
using YY.EventLogAssistant.Models;
using System;
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using YY.EventLogAssistant.Services;
using YY.EventLogAssistant.Models;
namespace YY.EventLogAssistant
{
public abstract partial class EventLogReader : IEventLogReader, IDisposable
{
#region Static Methods
public static EventLogReader CreateReader(string pathLogFile)
{
FileAttributes attr = File.GetAttributes(pathLogFile);
@ -43,6 +47,10 @@ namespace YY.EventLogAssistant
throw new ArgumentException("Invalid log file path");
}
#endregion
#region Private Member Variables
protected string _logFilePath;
protected string _logFileDirectoryPath;
protected long _currentFileEventNumber;
@ -60,6 +68,195 @@ namespace YY.EventLogAssistant
protected List<WorkServers> _workServers;
protected RowData _currentRow;
#endregion
#region Constructor
internal EventLogReader() : base() { }
internal EventLogReader(string logFilePath)
{
_logFilePath = logFilePath;
_logFileDirectoryPath = new FileInfo(_logFilePath).Directory.FullName;
_applications = new List<Applications>();
_computers = new List<Computers>();
_metadata = new List<Metadata>();
_events = new List<Events>();
_primaryPorts = new List<PrimaryPorts>();
_secondaryPorts = new List<SecondaryPorts>();
_users = new List<Users>();
_workServers = new List<WorkServers>();
ReadEventLogReferences();
}
#endregion
#region Public Properties
public IReadOnlyList<Applications> Applications { get { return _applications; } }
public IReadOnlyList<Computers> Computers { get { return _computers; } }
public IReadOnlyList<Metadata> Metadata { get { return _metadata; } }
public IReadOnlyList<Events> Events { get { return _events; } }
public IReadOnlyList<PrimaryPorts> PrimaryPorts { get { return _primaryPorts; } }
public IReadOnlyList<SecondaryPorts> SecondaryPorts { get { return _secondaryPorts; } }
public IReadOnlyList<Users> Users { get { return _users; } }
public IReadOnlyList<WorkServers> WorkServers { get { return _workServers; } }
public RowData CurrentRow { get { return _currentRow; } }
#endregion
#region Public Methods
public virtual bool Read()
{
throw new NotImplementedException();
}
public virtual bool GoToEvent(long eventNumber)
{
throw new NotImplementedException();
}
public virtual EventLogPosition GetCurrentPosition()
{
throw new NotImplementedException();
}
public virtual void SetCurrentPosition(EventLogPosition newPosition)
{
throw new NotImplementedException();
}
public virtual long Count()
{
throw new NotImplementedException();
}
public virtual void Reset()
{
throw new NotImplementedException();
}
public virtual void NextFile()
{
throw new NotImplementedException();
}
public virtual void Dispose()
{
_applications.Clear();
_computers.Clear();
_metadata.Clear();
_events.Clear();
_primaryPorts.Clear();
_secondaryPorts.Clear();
_users.Clear();
_workServers.Clear();
_currentRow = null;
}
public Users GetUserByCode(string code)
{
return GetUserByCode(code.ToInt64());
}
public Users GetUserByCode(long code)
{
return _users.Where(i => i.Code == code).FirstOrDefault();
}
public Computers GetComputerByCode(string code)
{
return GetComputerByCode(code.ToInt64());
}
public Computers GetComputerByCode(long code)
{
return _computers.Where(i => i.Code == code).FirstOrDefault();
}
public Applications GetApplicationByCode(string code)
{
return GetApplicationByCode(code.ToInt64());
}
public Applications GetApplicationByCode(long code)
{
return _applications.Where(i => i.Code == code).FirstOrDefault();
}
public Events GetEventByCode(string code)
{
return GetEventByCode(code.ToInt64());
}
public Events GetEventByCode(long code)
{
return _events.Where(i => i.Code == code).FirstOrDefault();
}
public Severity GetSeverityByCode(string code)
{
Severity severity;
switch (code.Trim())
{
case "I":
severity = Severity.Information;
break;
case "W":
severity = Severity.Warning;
break;
case "E":
severity = Severity.Error;
break;
case "N":
severity = Severity.Note;
break;
default:
severity = Severity.Unknown;
break;
}
return severity;
}
public Metadata GetMetadataByCode(string code)
{
return GetMetadataByCode(code.ToInt64());
}
public Metadata GetMetadataByCode(long code)
{
return _metadata.Where(i => i.Code == code).FirstOrDefault();
}
public WorkServers GetWorkServerByCode(string code)
{
return GetWorkServerByCode(code.ToInt64());
}
public WorkServers GetWorkServerByCode(long code)
{
return _workServers.Where(i => i.Code == code).FirstOrDefault();
}
public PrimaryPorts GetPrimaryPortByCode(string code)
{
return GetPrimaryPortByCode(code.ToInt64());
}
public PrimaryPorts GetPrimaryPortByCode(long code)
{
return _primaryPorts.Where(i => i.Code == code).FirstOrDefault();
}
public SecondaryPorts GetSecondaryPortByCode(string code)
{
return GetSecondaryPortByCode(code.ToInt64());
}
public SecondaryPorts GetSecondaryPortByCode(long code)
{
return _secondaryPorts.Where(i => i.Code == code).FirstOrDefault();
}
#endregion
#region Private Methods
protected virtual void ReadEventLogReferences() { }
#endregion
#region Events
public delegate void BeforeReadFileHandler(EventLogReader sender, BeforeReadFileEventArgs args);
public delegate void AfterReadFileHandler(EventLogReader sender, AfterReadFileEventArgs args);
public delegate void BeforeReadEventHandler(EventLogReader sender, BeforeReadEventArgs args);
@ -93,82 +290,6 @@ namespace YY.EventLogAssistant
OnErrorEvent?.Invoke(this, args);
}
internal EventLogReader() : base() { }
internal EventLogReader(string logFilePath)
{
_logFilePath = logFilePath;
_logFileDirectoryPath = new FileInfo(_logFilePath).Directory.FullName;
_applications = new List<Applications>();
_computers = new List<Computers>();
_metadata = new List<Metadata>();
_events = new List<Events>();
_primaryPorts = new List<PrimaryPorts>();
_secondaryPorts = new List<SecondaryPorts>();
_users = new List<Users>();
_workServers = new List<WorkServers>();
ReadEventLogReferences();
}
public IReadOnlyList<Applications> Applications { get { return _applications; } }
public IReadOnlyList<Computers> Computers { get { return _computers; } }
public IReadOnlyList<Metadata> Metadata { get { return _metadata; } }
public IReadOnlyList<Events> Events { get { return _events; } }
public IReadOnlyList<PrimaryPorts> PrimaryPorts { get { return _primaryPorts; } }
public IReadOnlyList<SecondaryPorts> SecondaryPorts { get { return _secondaryPorts; } }
public IReadOnlyList<Users> Users { get { return _users; } }
public IReadOnlyList<WorkServers> WorkServers { get { return _workServers; } }
public RowData Row { get { return _currentRow; } }
protected virtual void ReadEventLogReferences() { }
public virtual bool Read()
{
throw new NotImplementedException();
}
public virtual bool GoToEvent(long eventNumber)
{
throw new NotImplementedException();
}
public virtual EventLogPosition GetCurrentPosition()
{
throw new NotImplementedException();
}
public virtual void SetCurrentPosition(EventLogPosition newPosition)
{
throw new NotImplementedException();
}
public virtual long Count()
{
throw new NotImplementedException();
}
public virtual void Reset()
{
throw new NotImplementedException();
}
public virtual void NextFile()
{
throw new NotImplementedException();
}
public virtual void Dispose()
{
_applications.Clear();
_computers.Clear();
_metadata.Clear();
_events.Clear();
_primaryPorts.Clear();
_secondaryPorts.Clear();
_users.Clear();
_workServers.Clear();
_currentRow = null;
}
#endregion
}
}

466
YY.EventLogAssistant/YY.EventLogAssistant/LogParserLGF.cs
View File

@ -5,236 +5,374 @@ using System.Linq;
using System.Text;
using YY.EventLogAssistant.Services;
using System.Text.RegularExpressions;
using System.IO;
using System.Collections.Generic;
namespace YY.EventLogAssistant
{
internal sealed class LogParserLGF
{
private EventLogLGFReader _reader;
private Regex regexDataUUID;
#region Static Methods
public LogParserLGF(EventLogLGFReader reader)
public static bool ItsBeginOfEvent(string sourceString)
{
_reader = reader;
regexDataUUID = new Regex(@"[\d]+:[\dA-Za-zА-Яа-я]{32}}");
return Regex.IsMatch(sourceString, @"^{\d{4}\d{2}\d{2}\d+,");
}
public RowData Parse(string eventSource)
public static bool ItsEndOfEvent(string sourceString, ref int count, ref bool textBlockOpen)
{
var parseResult = ParseEventLogString(eventSource);
DateTime eventDate = DateTime.ParseExact(parseResult[0], "yyyyMMddHHmmss", CultureInfo.InvariantCulture);
RowData eventData = new RowData();
eventData.RowID = _reader.CurrentFileEventNumber;
eventData.Period = eventDate;
string TransStr = parseResult[2].ToString().Replace("}", "").Replace("{", "");
long TransDate = TransStr.Substring(0, TransStr.IndexOf(",")).From16To10();
try
{
if (!(TransDate == 0))
eventData.TransactionDate = new System.DateTime().AddSeconds((double)TransDate / 10000);
}
catch
{
eventData.TransactionDate = null;
}
eventData.TransactionId = TransStr.Substring(TransStr.IndexOf(",") + 1).From16To10();
if (parseResult[1] == "R")
eventData.TransactionStatus = TransactionStatus.Unfinished;
else if (parseResult[1] == "N")
eventData.TransactionStatus = TransactionStatus.NotApplicable;
else if (parseResult[1] == "U")
eventData.TransactionStatus = TransactionStatus.Committed;
else if (parseResult[1] == "C")
eventData.TransactionStatus = TransactionStatus.RolledBack;
else
eventData.TransactionStatus = TransactionStatus.Unknown;
eventData.Comment = parseResult[9].RemoveQuotes();
eventData.Session = Convert.ToInt32(parseResult[16]);
eventData.ConnectId = Convert.ToInt32(parseResult[6]);
eventData.DataPresentation = parseResult[12].RemoveQuotes();
eventData.Data = parseResult[11];
MatchCollection matches = regexDataUUID.Matches(eventData.Data);
if (matches.Count > 0)
{
string[] dataPartsUUID = eventData.Data.Split(':');
if (dataPartsUUID.Length == 2)
{
string dataUUID = dataPartsUUID[1].Replace("}", string.Empty);
eventData.DataUUID = dataUUID;
}
}
long userID = Convert.ToInt64(parseResult[3]);
eventData.User = _reader.Users.Where(i => i.Code == userID).FirstOrDefault();
long computerID = Convert.ToInt64(parseResult[4]);
eventData.Computer = _reader.Computers.Where(i => i.Code == computerID).FirstOrDefault();
long appID = Convert.ToInt64(parseResult[5]);
eventData.Application = _reader.Applications.Where(i => i.Code == appID).FirstOrDefault();
long eventID = Convert.ToInt64(parseResult[7]);
eventData.Event = _reader.Events.Where(i => i.Code == eventID).FirstOrDefault();
long metadataID = Convert.ToInt64(parseResult[10]);
eventData.Metadata = _reader.Metadata.Where(i => i.Code == metadataID).FirstOrDefault();
long workServerID = Convert.ToInt64(parseResult[13]);
eventData.WorkServer = _reader.WorkServers.Where(i => i.Code == workServerID).FirstOrDefault();
long pimaryPortID = Convert.ToInt64(parseResult[14]);
eventData.PrimaryPort = _reader.PrimaryPorts.Where(i => i.Code == pimaryPortID).FirstOrDefault();
long secondaryPortID = Convert.ToInt64(parseResult[15]);
eventData.SecondaryPort = _reader.SecondaryPorts.Where(i => i.Code == secondaryPortID).FirstOrDefault();
if (eventData.Data == "{\"U\"}") // 'empty reference
eventData.Data = string.Empty;
else if (eventData.Data.StartsWith("{"))
{
//'internal representation for different objects.
var ParsedObject = ParseEventLogString(eventData.Data);
if (ParsedObject.Length == 2)
{
if (ParsedObject[0] == "\"S\"" || ParsedObject[0] == "\"R\"")
{
//'this is string or reference
eventData.Data = ParsedObject[1].RemoveQuotes(); // 'string value
}
}
}
switch (parseResult[8].Trim())
{
case "I":
eventData.Severity = Severity.Information;
break;
case "W":
eventData.Severity = Severity.Warning;
break;
case "E":
eventData.Severity = Severity.Error;
break;
case "N":
eventData.Severity = Severity.Note;
break;
default:
eventData.Severity = Severity.Unknown;
break;
}
return eventData;
}
internal bool ItsEndOfEvent(string Str, ref int Count, ref bool TextBlockOpen)
{
string TempStr = Str;
string TempStr = sourceString;
for (int i = 0; i <= TempStr.Length - 1; i++)
{
string Simb = TempStr.Substring(i, 1);
if (Simb == "\"")
{
TextBlockOpen = !TextBlockOpen;
textBlockOpen = !textBlockOpen;
}
else if (Simb == "}" & !TextBlockOpen)
else if (Simb == "}" & !textBlockOpen)
{
Count = Count - 1;
count = count - 1;
}
else if (Simb == "{" & !TextBlockOpen)
else if (Simb == "{" & !textBlockOpen)
{
Count = Count + 1;
count = count + 1;
}
}
return (Count == 0);
return (count == 0);
}
internal string[] ParseEventLogString(string Text)
#endregion
#region Private Member Variables
private EventLogLGFReader _reader;
private Regex _regexDataUUID;
#endregion
#region Constructor
public LogParserLGF(EventLogLGFReader reader)
{
string[] ArrayLines = null;
_reader = reader;
_regexDataUUID = new Regex(@"[\d]+:[\dA-Za-zА-Яа-я]{32}}");
}
string Text2 = Text.Substring(1, (Text.EndsWith(",") ? Text.Length - 3 : Text.Length - 2)) + ",";
#endregion
string Str = "";
#region Public Methods
int Delim = Text2.IndexOf(",");
public void ReadEventLogReferences(
IList<Users> users,
IList<Computers> computers,
IList<Applications> applications,
IList<Events> events,
IList<Metadata> metadata,
IList<WorkServers> workServers,
IList<PrimaryPorts> primaryPorts,
IList<SecondaryPorts> secondaryPorts)
{
string empty = string.Empty;
string textReferencesData = empty;
using (FileStream FS = new FileStream(_reader.LogFilePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
using (StreamReader SR = new StreamReader(FS))
textReferencesData = SR.ReadToEnd();
int beginBlockIndex = textReferencesData.IndexOf("{");
if (beginBlockIndex < 0)
return;
textReferencesData = textReferencesData.Substring(beginBlockIndex);
string[] objectTexts = ParseEventLogString("{" + textReferencesData + "}");
string lastProcessedObjectForDebug;
foreach (string TextObject in objectTexts)
{
lastProcessedObjectForDebug = TextObject;
string[] parsedEventData = ParseEventLogString(TextObject);
if ((parsedEventData != null))
{
switch (parsedEventData[0])
{
case "1":
users.Add(new Users()
{
Code = parsedEventData[3].ToInt64(),
Uuid = parsedEventData[1].ToGuid(),
Name = parsedEventData[2]
});
break;
case "2":
computers.Add(new Computers()
{
Code = parsedEventData[2].ToInt64(),
Name = parsedEventData[1]
});
break;
case "3":
applications.Add(new Applications()
{
Code = parsedEventData[2].ToInt64(),
Name = parsedEventData[1]
});
break;
case "4":
events.Add(new Events()
{
Code = parsedEventData[2].ToInt64(),
Name = parsedEventData[1]
});
break;
case "5":
metadata.Add(new Metadata()
{
Code = parsedEventData[3].ToInt64(),
Uuid = parsedEventData[1].ToGuid(),
Name = parsedEventData[2]
});
break;
case "6":
workServers.Add(new WorkServers()
{
Code = parsedEventData[2].ToInt64(),
Name = parsedEventData[1]
});
break;
case "7":
primaryPorts.Add(new PrimaryPorts()
{
Code = parsedEventData[2].ToInt64(),
Name = parsedEventData[1]
});
break;
case "8":
secondaryPorts.Add(new SecondaryPorts()
{
Code = parsedEventData[2].ToInt64(),
Name = parsedEventData[1]
});
break;
//Case "9" - неизвестные значения, возможно связаны с разделением данных
//Case "10"
case "11":
break;
case "12":
break;
case "13":
break;
// Последние значения хранят статус транзакции и уровень события
default:
break;
}
}
}
}
public RowData Parse(string eventSource)
{
string[] parseResult = ParseEventLogString(eventSource);
string transactionSourceString = parseResult[2].RemoveBraces();
RowData eventData = new RowData();
eventData.RowID = _reader.CurrentFileEventNumber;
eventData.Period = DateTime.ParseExact(parseResult[0], "yyyyMMddHHmmss", CultureInfo.InvariantCulture);
eventData.TransactionStatus = GetTransactionStatus(parseResult[1]);
eventData.TransactionDate = GetTransactionDate(transactionSourceString);
eventData.TransactionId = GetTransactionId(transactionSourceString);
eventData.User = _reader.GetUserByCode(parseResult[3]);
eventData.Computer = _reader.GetComputerByCode(parseResult[4]);
eventData.Application = _reader.GetApplicationByCode(parseResult[5]);
eventData.ConnectId = parseResult[6].ToInt32();
eventData.Event = _reader.GetEventByCode(parseResult[7]);
eventData.Severity = _reader.GetSeverityByCode(parseResult[8]);
eventData.Comment = parseResult[9].RemoveQuotes();
eventData.Metadata = _reader.GetMetadataByCode(parseResult[10]);
eventData.Data = GetData(parseResult[11]);
eventData.DataUUID = GetDataUUID(eventData.Data);
eventData.DataPresentation = parseResult[12].RemoveQuotes();
eventData.WorkServer = _reader.GetWorkServerByCode(parseResult[13]);
eventData.PrimaryPort = _reader.GetPrimaryPortByCode(parseResult[14]);
eventData.SecondaryPort = _reader.GetSecondaryPortByCode(parseResult[15]);
eventData.Session = parseResult[16].ToInt64();
return eventData;
}
#endregion
#region Private Methods
private string GetData(string sourceString)
{
string data = sourceString;
if (data == "{\"U\"}")
data = string.Empty;
else if (data.StartsWith("{"))
{
string[] parsedObjects = ParseEventLogString(data);
if (parsedObjects.Length == 2)
{
if (parsedObjects[0] == "\"S\"" || parsedObjects[0] == "\"R\"")
{
data = parsedObjects[1].RemoveQuotes();
}
}
}
return data;
}
private string GetDataUUID(string sourceData)
{
string dataUUID;
MatchCollection matches = _regexDataUUID.Matches(sourceData);
if (matches.Count > 0)
{
string[] dataPartsUUID = sourceData.Split(':');
if (dataPartsUUID.Length == 2)
{
dataUUID = dataPartsUUID[1].Replace("}", string.Empty);
} else
dataUUID = string.Empty;
}
else
dataUUID = string.Empty;
return dataUUID;
}
private TransactionStatus GetTransactionStatus(string sourceString)
{
TransactionStatus transactionStatus;
if (sourceString == "R")
transactionStatus = TransactionStatus.Unfinished;
else if (sourceString == "N")
transactionStatus = TransactionStatus.NotApplicable;
else if (sourceString == "U")
transactionStatus = TransactionStatus.Committed;
else if (sourceString == "C")
transactionStatus = TransactionStatus.RolledBack;
else
transactionStatus = TransactionStatus.Unknown;
return transactionStatus;
}
private DateTime? GetTransactionDate(string sourceString)
{
DateTime? transactionDate;
long TransDate = sourceString.Substring(0, sourceString.IndexOf(",")).From16To10();
try
{
if (!(TransDate == 0))
transactionDate = new System.DateTime().AddSeconds((double)TransDate / 10000);
else
transactionDate = null;
}
catch
{
transactionDate = null;
}
return transactionDate;
}
private long? GetTransactionId(string sourceString)
{
long? transactionId;
transactionId = sourceString.Substring(sourceString.IndexOf(",") + 1).From16To10();
return transactionId;
}
private int CountSubstring(string sourceString, string sourceSubstring)
{
int countSubstring = (sourceString.Length - sourceString.Replace(sourceSubstring, "").Length) / sourceSubstring.Length;
return countSubstring;
}
private string[] ParseEventLogString(string sourceString)
{
string[] resultStrings = null;
string preparedString = sourceString.Substring(1, (sourceString.EndsWith(",") ? sourceString.Length - 3 : sourceString.Length - 2)) + ",";
string bufferString = string.Empty;
int delimIndex = preparedString.IndexOf(",");
int i = 0;
int partNumber = 0;
bool isSpecialString = false;
while (Delim > 0)
while (delimIndex > 0)
{
Str = Str + Text2.Substring(0, Delim).Trim();
bufferString = bufferString + preparedString.Substring(0, delimIndex).Trim();
partNumber += 1;
Text2 = Text2.Substring(Delim + 1);
if (partNumber == 1 && !String.IsNullOrEmpty(Str) && Str[0] == '\"')
preparedString = preparedString.Substring(delimIndex + 1);
if (partNumber == 1 && !String.IsNullOrEmpty(bufferString) && bufferString[0] == '\"')
isSpecialString = true;
int count1;
int count2;
int counter1, counter2;
if (isSpecialString)
{
count1 = 0;
count2 = 0;
counter1 = 0;
counter2 = 0;
}
else
{
count1 = CountSubstringInString(Str, "{");
count2 = CountSubstringInString(Str, "}");
counter1 = CountSubstring(bufferString, "{");
counter2 = CountSubstring(bufferString, "}");
}
int count3 = CountSubstringInString(Str, "\"") % 2; // Math.IEEERemainder(CountSubstringInString(Str, "\""), 2);
if (count1 == count2 & count3 == 0)
int counter3 = CountSubstring(bufferString, "\"") % 2;
if (counter1 == counter2 & counter3 == 0)
{
Array.Resize(ref ArrayLines, i + 1);
if (Str.StartsWith("\"") && Str.EndsWith("\""))
Array.Resize(ref resultStrings, i + 1);
if (bufferString.StartsWith("\"") && bufferString.EndsWith("\""))
{
Str = Str.Substring(1, Str.Length - 2);
bufferString = bufferString.Substring(1, bufferString.Length - 2);
}
if (isSpecialString)
{
char[] denied = new[] { '\n', '\t', '\r' };
StringBuilder newString = new StringBuilder();
foreach (var ch in Str)
foreach (var ch in bufferString)
if (!denied.Contains(ch))
newString.Append(ch);
Str = newString.ToString();
bufferString = newString.ToString();
}
ArrayLines[i] = Str;
i = i + 1;
Str = "";
resultStrings[i] = bufferString;
i += 1;
bufferString = string.Empty;
partNumber = 0;
isSpecialString = false;
}
else
{
Str = Str + ",";
}
bufferString += ",";
if (isSpecialString) // Особая обработка для поля "DataPresentation"
if (isSpecialString)
{
Delim = Text2.IndexOf("\",") + 1;
delimIndex = preparedString.IndexOf("\",") + 1;
}
else
{
Delim = Text2.IndexOf(",");
delimIndex = preparedString.IndexOf(",");
}
}
return ArrayLines;
return resultStrings;
}
private int CountSubstringInString(string Str, string SubStr)
{
return (Str.Length - Str.Replace(SubStr, "").Length) / SubStr.Length;
}
#endregion
}
}

2
YY.EventLogAssistant/YY.EventLogAssistantConsoleApp/Program.cs
View File

@ -15,7 +15,7 @@ namespace YY.EventLogAssistantConsoleApp
return;
string dataDirectoryPath = args[0];
Console.WriteLine($"{DateTime.Now}: Инициализация чтения логов ({dataDirectoryPath})...");
Console.WriteLine($"{DateTime.Now}: Инициализация чтения логов \"{dataDirectoryPath}\"...");
EventLogReader reader = EventLogReader.CreateReader(dataDirectoryPath);
reader.AfterReadEvent += Reader_AfterReadEvent;