Reading windows event log using win32evtlog module

问题

Below is the code, It's giving the total 87399 number of the log, but when reading the logs it only returns a 7 record list.

import win32evtlog

server = 'localhost'
logtype = 'Application'
hand = win32evtlog.OpenEventLog(server,logtype)
flags = win32evtlog.EVENTLOG_SEQUENTIAL_READ | win32evtlog.EVENTLOG_BACKWARDS_READ
total = win32evtlog.GetNumberOfEventLogRecords(hand)
events=win32evtlog.ReadEventLog(hand,flags,0)
print "Total number of Event record ",total  #Returning 87399
print "Log record read",len(events)  #Returning 7

for event in events:
    print 'Event Category:', event.EventCategory
    print 'Time Generated:', event.TimeGenerated
    print 'Source Name:', event.SourceName
    print 'Event ID:', event.EventID
    print 'Event Type:', event.EventType
    print 'Computer Name:', event.ComputerName
    print 'Data Name:', event.Data
    print type(event)

How to read all log records?

Thanks in advance

回答1:

import win32evtlog # requires pywin32 pre-installed

server = 'localhost' # name of the target computer to get event logs
logtype = 'System' # 'Application' # 'Security'
hand = win32evtlog.OpenEventLog(server,logtype)
flags = win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ
total = win32evtlog.GetNumberOfEventLogRecords(hand)

while True:
    events = win32evtlog.ReadEventLog(hand, flags,0)
    if events:
        for event in events:
            print 'Event Category:', event.EventCategory
            print 'Time Generated:', event.TimeGenerated
            print 'Source Name:', event.SourceName
            print 'Event ID:', event.EventID
            print 'Event Type:', event.EventType
            data = event.StringInserts
            if data:
                print 'Event Data:'
                for msg in data:
                    print msg
            print

Note: use while true to loop through the events so that we can get each event.

来源：https://stackoverflow.com/questions/42944791/reading-windows-event-log-using-win32evtlog-module

标签

python

readeventlog