張小呆的碎碎唸

之前有一篇文章提到 遠端收集特定主機之EventLog，這篇文章還有下文，那就是將每一個 EVT 檔拿回去公司時，有沒有辦法將這些資料，在不用還原到 事件檢視器 就可以進行資料查詢，以及資料分析呢!? 那時的我，只說能說：「沒辦法耶，可能要還原後，再用程式去讀取做查詢及分析」。直到遇到 Log Parser 時，我終於能說：「可以，並且我可以將資料寫入資料庫後，讓你查詢，並且可以搭配 Microsoft Chart Controls 來顯示你所要的圖表」。

呆言呆語：
Log Parser 2.2 安裝很簡單，且 MS 所提供的 Help 超好用，請多善用。

步驟一：先準備所要讀取的檔案

XML：在以下的功能中，會使用程式來產生

CSV檔：
ID, Name, Salary
11, 張 11, 11000
12, 張 12, 12000
13, 張 13, 13000
14, 張 14, 14000
15, 張 15, 15000

EVT：請自行將本機的事件檢視器另存

步驟二：將 Log Parser 加入 參考 當中



步驟三：佈一下 Window Form 的畫面


步驟四： 
using System.Xml; using LogQuery = MSUtil.LogQueryClassClass; using XmlInputFormat = MSUtil.COMXMLInputContextClass; using CsvInputFormat = MSUtil.COMCSVInputContextClass; using EvtInputFormat = MSUtil.COMEventLogInputContextClass; using LogRecordSet = MSUtil.ILogRecordset; DataTable dt; DataTable dtEVT; public Form1() { InitializeComponent(); dt = new DataTable(); dtEVT = new DataTable(); } private void Form1_Load(object sender, EventArgs e) { dt.Columns.Add("ID", typeof(int)); dt.Columns.Add("Name", typeof(string)); dt.Columns.Add("Salary", typeof(int)); dtEVT.Columns.Add("事件ID", typeof(string)); dtEVT.Columns.Add("日期", typeof(string)); dtEVT.Columns.Add("來源", typeof(string)); dtEVT.Columns.Add("描述", typeof(string)); } /// <summary> /// 產生 XML 檔 /// </summary> private void btnGenerateXML_Click(object sender, EventArgs e) { using (XmlWriter writer = XmlWriter.Create(@"C:\MemberData.xml")) { writer.WriteStartDocument(); writer.WriteStartElement("Employees"); for (int i = 1; i <= 5; i++) { writer.WriteStartElement("Employee"); writer.WriteElementString("ID", i.ToString()); writer.WriteElementString("Name", "張 " + i + " 呆"); writer.WriteElementString("Salary", (i * 10000).ToString()); writer.WriteEndElement(); } writer.WriteEndElement(); writer.WriteEndDocument(); MessageBox.Show("完成產生 XML 檔"); } } /// <summary> /// 讀取 XML 檔 /// </summary> private void btnReadXML_Click(object sender, EventArgs e) { try { ClearDataTable(); // Instantiate the LogQuery object LogQuery oLogQuery = new LogQuery(); // Instantiate the Event Log Input Format object XmlInputFormat oXmlInputFormat = new XmlInputFormat(); // Set its "fMode" parameter to "Tree" oXmlInputFormat.fMode = "Tree"; // Create the query string query = @"SELECT * FROM C:\MemberData.xml#/Employees/Employee"; // Execute the query LogRecordSet oRecordSet = oLogQuery.Execute(query, oXmlInputFormat); while (!oRecordSet.atEnd()) { var itemData = oRecordSet.getRecord(); DataRow dr = dt.NewRow(); dr["ID"] = Convert.ToInt32(itemData.getValue("ID")); dr["Name"] = itemData.getValue("Name").ToString(); dr["Salary"] = Convert.ToInt32(itemData.getValue("Salary")); dt.Rows.Add(dr); oRecordSet.moveNext(); } dataGridView1.DataSource = dt; // Close the recordset oRecordSet.close(); } catch (System.Runtime.InteropServices.COMException exc) { MessageBox.Show("Unexpected error: " + exc.Message); } } /// <summary> /// 讀取 XML 檔，並且 Order By Salary DESC /// </summary> private void btnReadXMLOrderBy_Click(object sender, EventArgs e) { try { ClearDataTable(); // Instantiate the LogQuery object LogQuery oLogQuery = new LogQuery(); // Instantiate the Event Log Input Format object XmlInputFormat oXmlInputFormat = new XmlInputFormat(); // Set its "fMode" parameter to "Tree" oXmlInputFormat.fMode = "Tree"; // Create the query string query = @"SELECT * FROM C:\MemberData.xml#/Employees/Employee ORDER BY Salary DESC"; // Execute the query LogRecordSet oRecordSet = oLogQuery.Execute(query, oXmlInputFormat); while (!oRecordSet.atEnd()) { var itemData = oRecordSet.getRecord(); DataRow dr = dt.NewRow(); dr["ID"] = itemData.getValue("ID").ToString(); dr["Name"] = itemData.getValue("Name").ToString(); dr["Salary"] = itemData.getValue("Salary").ToString(); dt.Rows.Add(dr); oRecordSet.moveNext(); } dataGridView1.DataSource = dt; // Close the recordset oRecordSet.close(); } catch (System.Runtime.InteropServices.COMException exc) { MessageBox.Show("Unexpected error: " + exc.Message); } } /// <summary> /// 讀取 CSV 檔 /// </summary> private void btnReadCSV_Click(object sender, EventArgs e) { try { ClearDataTable(); // Instantiate the LogQuery object LogQuery oLogQuery = new LogQuery(); // Instantiate the Event Log Input Format object CsvInputFormat oCsvInputFormat = new CsvInputFormat(); // Create the query string query = @"SELECT * FROM C:\MemberData2.csv"; // Execute the query LogRecordSet oRecordSet = oLogQuery.Execute(query, oCsvInputFormat); while (!oRecordSet.atEnd()) { var itemData = oRecordSet.getRecord(); DataRow dr = dt.NewRow(); dr["ID"] = Convert.ToInt32(itemData.getValue("ID")); dr["Name"] = itemData.getValue("Name").ToString(); dr["Salary"] = Convert.ToInt32(itemData.getValue("Salary")); dt.Rows.Add(dr); oRecordSet.moveNext(); } dataGridView1.DataSource = dt; // Close the recordset oRecordSet.close(); } catch (System.Runtime.InteropServices.COMException exc) { MessageBox.Show("Unexpected error: " + exc.Message); } } /// <summary> /// 讀取 EVT 檔 /// </summary> private void btnReadEVT_Click(object sender, EventArgs e) { try { ClearDataTable(); // Instantiate the LogQuery object LogQuery oLogQuery = new LogQuery(); // Instantiate the Event Log Input Format object EvtInputFormat oEvtInputFormat = new EvtInputFormat(); // Set its "direction" parameter to "BW" oEvtInputFormat.direction = "BW"; // Create the query string query = @"SELECT EventID, TimeGenerated, SourceName, Message FROM C:\SystemEventLog.evt"; // Execute the query LogRecordSet oRecordSet = oLogQuery.Execute(query, oEvtInputFormat); while (!oRecordSet.atEnd()) { var itemData = oRecordSet.getRecord(); DataRow dr = dtEVT.NewRow(); dr["事件ID"] = itemData.getValue("EventID").ToString(); dr["日期"] = itemData.getValue("TimeGenerated").ToString(); dr["來源"] = itemData.getValue("SourceName").ToString(); dr["描述"] = itemData.getValue("Message").ToString(); dtEVT.Rows.Add(dr); oRecordSet.moveNext(); } dataGridView1.DataSource = dtEVT; // Close the recordset oRecordSet.close(); } catch (System.Runtime.InteropServices.COMException exc) { MessageBox.Show("Unexpected error: " + exc.Message); } } /// <summary> /// 讀取 EVT 檔，並且 Where EventID = '7036' /// </summary> private void btnReadEVTWhere_Click(object sender, EventArgs e) { try { ClearDataTable(); // Instantiate the LogQuery object LogQuery oLogQuery = new LogQuery(); // Instantiate the Event Log Input Format object EvtInputFormat oEvtInputFormat = new EvtInputFormat(); // Set its "direction" parameter to "BW" oEvtInputFormat.direction = "BW"; // Create the query string query = @"SELECT EventID, TimeGenerated, SourceName, Message FROM C:\SystemEventLog.evt Where EventID = '7036'"; // Execute the query LogRecordSet oRecordSet = oLogQuery.Execute(query, oEvtInputFormat); while (!oRecordSet.atEnd()) { var itemData = oRecordSet.getRecord(); DataRow dr = dtEVT.NewRow(); dr["事件ID"] = itemData.getValue("EventID").ToString(); dr["日期"] = itemData.getValue("TimeGenerated").ToString(); dr["來源"] = itemData.getValue("SourceName").ToString(); dr["描述"] = itemData.getValue("Message").ToString(); dtEVT.Rows.Add(dr); oRecordSet.moveNext(); } dataGridView1.DataSource = dtEVT; // Close the recordset oRecordSet.close(); } catch (System.Runtime.InteropServices.COMException exc) { MessageBox.Show("Unexpected error: " + exc.Message); } } /// <summary> /// 清除 DataTable 資料 /// </summary> private void ClearDataTable() { dt.Rows.Clear(); dtEVT.Rows.Clear(); }

結果： 





參考：
Log Parser 2.2
介紹好用工具：Log Parser (分析多種 Log 格式的超強工具)
C# XmlWriter Tutorial
如何：使用 Visual C# .NET 從檔案讀取 XML
Log Parser-記錄檔分析器
用Log Parser和C#打造網站訪問統計分析系統