我正在编写一个程序,需要知道如何根据记录号读取Windows事件日志中的特定条目,该脚本已经具备。以下是我一直在使用的代码,但我不想循环遍历所有事件直到找到我要查找的那一个。有什么想法吗?
import win32evtlog
server = 'localhost' # name of the target computer to get event logs
logtype = 'System'
hand = win32evtlog.OpenEventLog(server,logtype)
flags = win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ
total = win32evtlog.GetNumberOfEventLogRecords(hand)
while True:
events = win32evtlog.ReadEventLog(hand, flags,0)
if events:
for event in events:
if event.EventID == "27035":
print 'Event Category:', event.EventCategory
print 'Time Generated:', event.TimeGenerated
print 'Source Name:', event.SourceName
print 'Event ID:', event.EventID
print 'Event Type:', event.EventType
data = event.StringInserts
if data:
print 'Event Data:'
for msg in data:
print msg
break
win32evtlog.CloseEventLog(hand)
。 - twasbrillig