Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
because the server writes a line to the file when a connection is established and
another line when the connection is terminated; at this point in time this project is
only interested in the data that is being sent from the client.
// Declare new instance of StreamReader and tell it the filename.
StreamReader sr = new StreamReader("c:\\EvtLog2.log");
// Decalare local variable.
string line;
// Repeat the following until all lines are read from file.
while ((line = sr.ReadLine()) != null)
{
// Only copy the lines that contain .
if(line.Contains(""))
{
// Add the lines to the array called ‘lines’.
lines.Add(line);
}
}
// Close the file.
sr.Close();
Figure 31: Reading a file
5.4.2 Decoding XML
To convert the flat XML strings that are contained within the Log file a simple piece
of code was written that could extract the data. Figure 32 shows this for extracting the
data from the tags. First it calculates the starting point of the required
data by working out the size of the opening tag. Then it calculates the end point of the
data based upon the length of the closing tag. It then displays the data on the screen.
// Copy the currently selected array item to string1.
string string1 = Convert.ToString(lines[arrayItem]);
// Define the start tag.
string myString1 = "";
// Define the end tag.
string myString2 = "";
// Calculate the starting and ending points of the data contined
// within the start and end tags.
serverTimeLbl.Text = string1.Substring((string1.IndexOf(myString1) +
myString1.Length), (string1.IndexOf(myString2) -
(string1.IndexOf(myString1) + myString1.Length)));
// Repeat this process for all the tags.
Figure 32: Dividing up an XML string
48