XML Parsing

hey all,

my apologies in advance simple problem of you. if through history you'll see i'm not particularly happy get-eventlog / get-winevent 1 reason or (whether it's speed, output format, or incompatibility between operating systems)

so i'm looking @ using wevtutil.exe pull event logs , export them in xml format. wevtutil fast, , seems work same between 2008 / 2008 r2 - output format xml , haven't experience manipulating that.

lincoln atkinson gave me start @ http://social.technet.microsoft.com/forums/en-us/winserverpowershell/thread/1b4abbbd-c0de-451d-b50c-49aecc276033 created thread complain get-winevent thought i'd start new thread here deal parsing xml (joys!)

whilst lincolns script pull data, it's odd in after running script few times (or once), wevtutil stop outputting anything. after bunch of trials figured may run wevtutil , have output xml first, it's nice have raw xml output anyway.

this should pull failure audit events within last 24 hours , put file called example.xml..
wevtutil.exe qe security /rd:true /f:xml /q:"*[system[provider[@name='microsoft-windows-security-auditing'] , (band(keywords,4503599627370496)) , timecreated[timediff(@systemtime) <= 86400000]]]" /e:events >> example.xml

an example of contents of file..

  <events>  <event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><system><provider name='microsoft-windows-security-auditing' guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><eventid>4776</eventid><version>0</version><level>0</level><task>14336</task><opcode>0</opcode><keywords>0x8010000000000000</keywords><timecreated systemtime='2010-12-17t16:20:36.429565400z'/><eventrecordid>9261098</eventrecordid><correlation/><execution processid='588' threadid='76368'/><channel>security</channel><computer>computer.domain.local</computer><security/></system><eventdata><data name='packagename'>microsoft_authentication_package_v1_0</data><data name='targetusername'>administrator</data><data name='workstation'>wibble-pc</data><data name='status'>0xc000006a</data></eventdata><renderinginfo culture='en-gb'><message>the computer attempted validate credentials account.    authentication package:	microsoft_authentication_package_v1_0  logon account:	wibble  source workstation:	wibble-pc  error code:	0xc000006a</message><level>information</level><task>credential validation</task><opcode>info</opcode><channel>security</channel><provider>microsoft windows security auditing.</provider><keywords><keyword>audit failure</keyword></keywords></renderinginfo></event>  </events>  

so did few searchs parsing xml , came across few different examples, seeing as i'm starting out basic begin with, james blog @ http://jamesmccaffrey.wordpress.com/2007/12/02/parsing-xml-files-with-powershell/ seemed ideal.. there example xml file , code there adapt.

to begin with, figured i'd try..

  [system.xml.xmldocument] $xd = new-object system.xml.xmldocument  $file = resolve-path("example.xml")  $xd.load($file)  $nodelist = $xd.selectnodes("/events/event") # xpath case sensitive  foreach ($testcasenode in $nodelist) {   $systemnode = $testcasenode.selectsinglenode("system")   $eventid = $systemnode.eventid     write-host "eventid = $eventid"  }      

which doesn't return anything. if edit .xml file so <event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'> becomes <event> - code works fine. string replace via powershell before processing file i'd avoid , understand why example doesn't work (other examples formatted files seem suggest should work.

once understand that, next problem becomes sort of checking, because <message></message> field can contain incorrect characters (i.e attempts relay via server using username different character set) when that's processed null or invalid.

i appreciate i'm in on head, there's fair amount need learn - pointers appreciated.

well, need can done in 2 lines of code... ;)

$myxml = [xml](get-content example.xml)
$myxml.events.event | foreach-object { write-host 'eventid =' $_.system.eventid }

i'm not xml expert, can't original question, why selectnodes not work initial xml syntax. anyway got same results, guess it's 'by design' (in powershell).

hth

bartek

Windows Server  >  Windows PowerShell