File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/win_event.cpython-310.pyc
Back
o ;j8\ � @ s d Z ddlZddlZddlZddlZddlmZ zddlZddl Z ddl Z ddl Z ddl Z dZ W n ey; dZ Y nw e�e�ZdZdd� Zd)d d �Zd d � Zdd� Zdd� Zdd� Zdd� Zdd� Zd*dd�Zdd� Z d+d d �Z d*d d �Z d!d"� Z d,d#d$�Z d-d%d&�Z!d'd(� Z"dS ).zR A module for working with the Windows Event log system. .. versionadded:: 3006.0 � N)�CommandExecutionErrorTFZ win_eventc C s t jj�� sdS ts dS tS )z2 Load only on minions running on Windows. )Fz win_event: Must be on Windows)Fzwin_event: Missing PyWin32)�salt�utils�platformZ is_windows� IMPORT_STATUS�__virtualname__� r r �J/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/win_event.py� __virtual__! s r �utf-8c C s� t | t�r"i }| D ]}t| | |�}|rt||�}|||< q |} | S t | t�r:g }| D ] }|�t||�� q+|} | S t | t�rTg }| D ] }|�t||�� qCt|�} | S t | t�r^| �|�} | S )a Convert string objects to byte objects. .. warning:: This function will destroy the data object and objects that data links to. Args: data (object): The string object to encode encoding (:obj:`str`, optional): The encoding type. Default is "utf-8". encode_keys (:obj:`bool`, optional): If ``False``, key strings will not be encoded. Defaults is ``False``. Returns: (object): An object with the new encoding )� isinstance�dict� _to_bytes�list�append�tuple�str�encode)�data�encodingZ encode_keysZnew_dict�key�itemZnew_listr r r r - s0 � � � r c C s* t �dd�}|| j| j| j| j| j| j�S )z� Will make a pywintypes.datetime into a TimeTuple. Args: time (obj): A datetime object Returns: TimeTuple: A TimeTuple � TimeTuplez&year, month, day, hour, minute, second)� collections� namedtuple�year�month�day�hour�minute�second)�timer r r r � _raw_timeb s ��r" c C s� d}i }|D ]}t | |d �� |dd� d�||< qt�|d �|d< |d dur2|d �� |d< t|d �|d< t|d �|d< t|�S ) z� Will make a PyEventLogRecord into a dictionary Args: event (PyEventLogRecord): An event to convert to a dictionary Returns: dict: A dictionary containing the event information )ZclosingRecordNumberZ computerNamer � eventCategory�eventID� eventTypeZ recordNumberZreservedZ reservedFlags�sidZ sourceNameZ stringInserts� timeGenerated� timeWrittenr � Nr$ r& r' r( )�getattr�upper�winerrorZ HRESULT_CODEZGetSidIdentifierAuthorityr" r )�eventZ event_partsZ event_dictZ event_partr r r �_make_event_dictv s � r. c C s@ zt �d| �W S tjy } z td| � d|j� ���d}~ww )z� Will try to open a PyHANDLE to the Event System Args: log_name (str): The name of the log to open Returns: PyHANDLE: A handle to the event log NzFailed to open log: z Error: )� win32evtlogZ OpenEventLog� pywintypes�error�FileNotFoundError�strerror)�log_name�excr r r � _get_handle� s ���r6 c C s t �| � dS )z| Will close the handle to the event log Args: handle (PyHANDLE): The handle to the event log to close N)r/ Z CloseEventLog)�handler r r � _close_handle� s r8 c c sN � t | �}tjtjB } t�||d�}|sn |D ]}t|�V qq t|� dS )z� Get all log events one by one. Events are not ordered Args: log_name(str): The name of the log to retrieve Yields: dict: A dictionary object for each event Tr N)r6 r/ ZEVENTLOG_BACKWARDS_READZEVENTLOG_SEQUENTIAL_READZ ReadEventLogr. r8 )r4 r7 �flags�eventsr- r r r �_event_generator� s � � r; c c s^ � d}t | �D ]%}i }|D ]}|| ||< q t|�D ] \}}|d | ||< q||fV qdS )z� Sorts the results of the event generator Args: log_name (str): The name of the log to retrieve Yields: dict: A dictionary object for each event )r r r r r r r' N)r; � enumerate)r4 Z time_partsr- Z event_info�partZspotr r r r �_event_generator_with_time� s � �r> c k sp � t | �D �]/\}}|r�|D ]�}|�d�rq|dv rqt|| t�r�z\t�dt|| �t|| �d��� || || �d�kr}z)t�dt|| �t|| �d��d��� || || �d��d�krhW W n7W n t y| t�d|| � Y W n#w W q t y� t�d || � Y nw || || kr� nq|V q|D ]�}|�d�r�q�|dv r�q�t|| t��r(z"t�dt|| �t|| �d��� || || �d�kr�|V W n t y� t�d || � Y nw z)t�dt|| �t|| �d��d��� || || �d��d�k�r|V W q� t �y' t�d|| � Y nw || || k�r4|V q�qd S ) a� Will find events that meet the requirements in the filter. Can be any item in the return for the event. Args: log_name (str): The name of the log to retrieve all_requirements (bool): Should the results match all requirements. ``True`` matches all requirements. ``False`` matches any requirement. Kwargs: eventID (int): The event ID number eventType (int): The event type number. Valid options and their corresponding meaning are: - 0 : Success - 1 : Error - 2 : Warning - 4 : Information - 8 : Audit Success - 10 : Audit Failure year (int): The year month (int): The month day (int): The day of the month hour (int): The hour minute (int): The minute second (int): The second eventCategory (int): The event category number sid (sid): The SID of the user that created the event sourceName (str): The name of the event source Yields: dict: A dictionary object for each event CLI Example: .. code-block:: python # Return all events from the Security log with an ID of 1100 _event_generator_filter("Security", eventID=1100) # Return all events from the System log with an Error (1) event type _event_generator_filter("System", eventType=1) # Return all events from System log with an Error (1) type, source is Service Control Manager, and data is netprofm _event_generator_filter("System", eventType=1, sourceName="Service Control Manager", data="netprofm") �__)r4 Z all_argumentszutf-8: Does %s == %sr zutf-16: Does %s == %szutf-16� z Failed to decode (utf-16): %sz Failed to decode (utf-8): %sN) r> � startswithr �bytes�logZtrace�repr�decode�strip�UnicodeDecodeError)r4 �all_requirements�kwargsr- �infor r r r �_event_generator_filter s� �? � ��� �� ��� �� � � ����rK c C s t t| ��S )a Get events from the specified log. Get a list of available logs using the :py:func:`win_event.get_log_names <salt.modules.win_event.get_log_names>` function. .. warning:: Running this command on a log with thousands of events, such as the ``Applications`` log, can take a long time. Args: log_name (str): The name of the log to retrieve. Returns tuple: A tuple of events as dictionaries CLI Example: .. code-block:: bash salt '*' win_event.get Application )r r; )r4 r r r �get� s rL � c C sz t |t�s td��tj}|stj}t�| ||d�}g }t�||�D ]}|r,t�|d�} n t � t�|d��} |� | � q!|S )a2 Query a log for a specific event_id. Return the top number of records specified. Use the :py:func:`win_event.get_log_names <salt.modules.win_event.get_log_names>` to see a list of available logs on the system. .. Note:: You can use the Windows Event Viewer to create the XPath query for the ``query_text`` parameter. Click on ``Filter Current Log``, configure the filter, then click on the XML tab. Copy the text between the two ``<Select>`` tags. This will be the contents of the ``query_text`` parameter. You will have to convert some codes. For example, ``>`` becomes ``>``, ``<`` becomes ``<``. Additionally, you'll need to put spaces between comparison operators. For example: ``this >= that``. Args: log_name (str): The name of the log to query query_text (:obj:`str`, optional): The filter to apply to the log. Default is ``None``. records (:obj:`int`, optional): The number of records to return. Default is 20 latest (:obj:`bool`, optional): ``True`` will return the newest events. ``False`` will return the oldest events. Default is ``True``. raw (:obj:`bool`, optional): ``True`` will return the raw xml results. ``False`` will return the xml converted to a dictionary. Default is ``False``. Returns: list: A list of dict objects that contain information about the event CLI Example: .. code-block:: bash # Return the 20 most recent events from the Application log with an event ID of 22 salt '*' win_event.query Application '*[System[(EventID=22)]]' # Return the 20 most recent events from the Application log with an event ID of 22 # Return raw xml salt '*' win_event.query Application '*[System[(EventID=22)]]' raw=True # Return the 20 oldest events from the Application log with an event ID of 22 salt '*' win_event.query Application '*[System[(EventID=22)]]' latest=False # Return the 20 most recent Critical (1) events from the Application log in the last 12 hours salt '*' win_event.query Application '*[System[(Level=1) and TimeCreated[timediff(@SystemTime) <= 43200000]]]' # Return the 5 most recent Error (2) events from the application log salt '*' win_event.query Application '*[System[(Level=2)]]' records=5 # Return the 20 most recent Warning (3) events from the Windows PowerShell log where the Event Source is PowerShell salt '*' win_event.query 'Windows PowerShell' '*[System[Provider[@Name="PowerShell"] and (Level=3)]]' # Return the 20 most recent Information (0 or 4) events from the Microsoft-Windows-PowerShell/Operational on 2022-08-24 with an Event ID of 4103 salt '*' win_event.query 'Microsoft-Windows-PowerShell/Operational' '*[System[(Level=4 or Level=0) and (EventID=4103) and TimeCreated[@SystemTime >= "2022-08-24T06:00:00.000Z"]]]' # Return the 20 most recent Information (0 or 4) events from the Microsoft-Windows-PowerShell/Operational within the last hour salt '*' win_event.query 'Microsoft-Windows-PowerShell/Operational' '*[System[(Level=4 or Level=0) and TimeCreated[timediff(@SystemTime) <= 3600000]]]' zlatest must be a booleanNr) ) r �boolr r/ ZEvtQueryReverseDirectionZEvtQueryForwardDirectionZEvtQueryZEvtNextZ EvtRender� xmltodict�parser ) r4 Z query_text�recordsZlatest�raw� direction�resultsZ event_listZevt�resr r r �query� s F rV c K s t t| |fi |���S )a# Will find events that match the fields and values specified in the kwargs. Kwargs can be any item in the return for the event. .. warning:: Running this command on a log with thousands of events, such as the ``Applications`` log, can take a long time. Args: log_name (str): The name of the log to retrieve all_requirements (:obj:`bool`, optional): ``True`` matches all requirements. ``False`` matches any requirement. Default is ``True``. Kwargs: eventID (int): The event ID number eventType (int): The event type number. Valid options and their corresponding meaning are: - 0 : Success - 1 : Error - 2 : Warning - 4 : Information - 8 : Audit Success - 10 : Audit Failure year (int): The year month (int): The month day (int): The day of the month hour (int): The hour minute (int): The minute second (int): The second eventCategory (int): The event category number sid (sid): The SID of the user that created the event sourceName (str): The name of the event source Returns: tuple: A tuple of dicts of each filtered event CLI Example: .. code-block:: bash # Return all events from the Security log with an ID of 1100 salt '*' win_event.get_filtered Security eventID=1100 # Return all events from the System log with an Error (1) event type salt '*' win_event.get_filtered System eventType=1 # Return all events from System log with an Error (1) type, source is Service Control Manager, and data is netprofm salt '*' win_event.get_filtered System eventType=1 sourceName='Service Control Manager' data='netprofm' # Return events from the System log that match any of the kwargs below salt '*' win_event.get_filtered System eventType=1 sourceName='Service Control Manager' data='netprofm' all_requirements=False )r rK )r4 rH rI r r r � get_filtered s FrW c C s> t �d�} g }t �| �dur |�t �| �� t �| �dus|S )z� Get a list of event logs available on the system Returns: list: A list of event logs available on the system CLI Example: .. code-block:: bash salt '*' win_event.get_log_names N)r/ ZEvtOpenChannelEnumZEvtNextChannelPathr )�hZ log_namesr r r � get_log_namesO s �rY c C s zt |�}W n ty td��w zt |�}W n ty# td��w ddddddd d d d d dd� }|du r<|d }n||vrId|� �}t|��|| }|durct|t�rZ|g}n t|t�sctd��|durntjj� |�}t j | t |�t |�||||d� dS )a� Adds an event to the application event log. Args: log_name (str): The name of the application or source event_id (int): The event ID event_category (:obj:`int`, optional): The event category. Default is 0 event_type (:obj:`str`, optional): The event category. Must be one of: - Success - Error - Warning - Information - AuditSuccess - AuditFailure Default is ``None``. event_strings (:obj:`list`, optional): A list of strings. Default is ``None``. event_data (:obj:`bytes`, optional): Event data. Strings will be converted to bytes. Default is ``None``. event_sid (:obj:`sid`, optional): The SID for the event. Default is ``None``. Raises: CommandExecutionError: event_id is not an integer CommandExecutionError: event_category is not an integer CommandExecutionError: event_type is not one of the valid event types CommandExecutionError: event_strings is not a list or string CLI Example: .. code-block:: bash # A simple Application event log warning entry salt '*' win_event.add Application 1234 12 Warning # A more complex System event log information entry salt '*' win_event.add System 1234 12 Information '["Event string data 1", "Event string data 2"]' 'Some event data' # Log to the System Event log with the source "Service Control Manager" salt '*' win_event.add 'Service Control Manager' 1234 12 Warning '["Event string data 1", "Event string data 2"]' 'Some event data' .. code-block:: powershell # Log to the PowerShell event log with the source "PowerShell (PowerShell)" salt-call --local win_event.add "PowerShell" 6969 12 Warning zevent_id must be an integerz!event_category must be an integerr r) � � � � �Success�Error�Warning� Information� AuditSuccess� AuditFailure) r^ r_ r` ra rb rc r r) rZ r[ r\ r] NzIncorrect event type: z event_strings must be a list)ZappNamer$ r# r% �stringsr r& ) �int� TypeErrorr r r r r r Z stringutils�to_bytes�win32evtlogutilZ ReportEvent) r4 Zevent_idZevent_categoryZ event_typeZ event_stringsZ event_dataZ event_sidZ event_types�msgr r r �addc sZ G � �� �rj c C s t | �}t�||� t|� dS )a� Clears the specified event log. .. note:: A clear log event will be added to the log after it is cleared. Args: log_name (str): The name of the log to clear backup (:obj:`str`, optional): Path to backup file. Default is ``None``. CLI Example: .. code-block:: bash salt "*" win_event.clear Application N)r6 r/ Z ClearEventLogr8 )r4 Zbackupr7 r r r �clear� s rk c C s t | �}t�|�}t|� |S )a Gets the number of events in the specified. Args: log_name (str): The name of the log Returns: int: The number of events the log contains CLI Example: .. code-block:: bash salt "*" win_event.count Application )r6 r/ ZGetNumberOfEventLogRecordsr8 )r4 r7 Znumber_of_eventsr r r �count� s rl )r F)T)NrM TF)r NNNN)N)#�__doc__r �loggingZsalt.utils.platformr Zsalt.utils.stringutilsZsalt.exceptionsr r0 r/ rh r, rO r � ImportError� getLogger�__name__rC r r r r" r. r6 r8 r; r> rK rL rV rW rY rj rk rl r r r r �<module> sP � 5. ZI � }
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings