Re: Regarding Windows Event Log File Parser in JAVA
amit3281 wrote:
Hi,
Thanks for this stuff it's very helpful, but i am naive user in java
and i am unable to play with binary data to move to particular offset
and to read data from this pattern also i need to run this code in
Linux for JAVA.
Just so I'm not misunderstanding you. You want to parse backed-up
Win32 event log files, not manipulate active event logs?
Is this correct? If so:
I'm not certain why you want to read Win32 event log files on
a Linux platform, but... There seems to be many gotchas involved
in the whole \wide\ topic of Win32 Event logging system.
cf: <http://www.grimes.demon.co.uk/workshops/InstrWSEight.htm>
One practical matter seems to be data format the files are written to.
See below for retrieving the header info.
Can you explain me binary data handling, I am a c++ user
commands for playing with byte arrays move to particular offset, skip
partikular offset, as in c++ i can very well do it using pointers but
i don't know how to do it with java
Probably not. I'm pretty new to Java myself.
Java has Basic I/O and New I/O. For an overview tutorial see:
<http://java.sun.com/docs/books/tutorial/essential/io/index.html>
Maybe a java.io.RandomAccessFile type would work well here. ?
If you weren't working from a Linux platform, and given that
you are familiar with C++, I would say that probably the mobetter
way to approach this would be through Java Native Interface to
the Win32 API.
This writes a basic header to a file and reads it back on
my Win32 platform. I can use it to read header info from backed-up
event log files on my system.
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
public class Test
{
public static void main(String[] args)
{
FileInputStream fis;
FileOutputStream fos;
try
{
Win32EventLogHeader header =
new Win32EventLogHeader();
fos = new FileOutputStream("test");
header.writeHeader(fos);
fos.close();
fis = new FileInputStream("test");
header.readHeader(fis);
fis.close();
}
catch (FileNotFoundException e)
{
e.printStackTrace();
}
catch (IOException e)
{
e.printStackTrace();
}
}
public static class Win32EventLogHeader
{
public int[] data = {0x30,0x654C664C,0x1,0x1,
-0x1,-0x1,-0x1,0x0,0x80000,0x0,0x0,0x30};
public void writeHeader(OutputStream out)
throws IOException
{
for(int i : data)
{
ByteBuffer buff = ByteBuffer.allocate(4);
buff.order(ByteOrder.LITTLE_ENDIAN).putInt(i);
out.write(buff.array());
}
}
public void readHeader(InputStream in)
throws IOException
{
int count = 0;
int tmp;
while((tmp = in.read()) > -1 && count < 12)
{
data[count] = Integer.reverseBytes(tmp);
}
}
}
}