Perfmon .blg 文件规范/解析库
在哪里可以找到 Perfmon 二进制 .blg 文件格式的详细、低级规范？或者更好的是，是否有人编写了一个低级开源库（最好用 C 语言，但任何语言都可以）来解析 .blg 文件？
Where can I find a detailed, low-level spec for the Perfmon binary .blg file format? Or even better, has anyone written a low level, open source library (preferably in C, but any language would do) for parsing .blg files?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
有一个名为 relog 的工具可以将这些文件转换为 csv 或其他格式。
http:// /blog.bennett-scharf.com/2008/12/17/converting-an-existing-perfmon-blg-file-to-csv/
链接
链接
There's a tool called relog that can convert these files to csv or other formats.
http://blog.bennett-scharf.com/2008/12/17/converting-an-existing-perfmon-blg-file-to-csv/
Link
Link
这对于查看历史数据没有帮助，但如果您有权访问运行 Perfmon 的系统，您可能需要查看 Logman。使用 Logman，您可以设置性能计数器并指定输出格式，这样您就可以选择易于解析的格式。请参阅
-f选项：-f { bin |滨环 | csv|电视 | SQL } ：指定用于收集性能计数器和跟踪数据的文件格式。收集性能计数器时，您可以使用二进制、循环二进制、逗号和制表符分隔或 SQL 数据库格式。正如其他人所说，如果您还有需要解析的历史记录，您可以使用 Relog 实用程序，用于将现有 .blg 文件转换为更有用的格式。
This won't help for looking at historical data, but if you have access to the systems running Perfmon, you may want to look at Logman. With Logman you can set performance counters AND specify the output format, that way you can just chose a format that is easy to parse. See the
-foption:-f { bin | bincirc | csv | tsv | SQL } : Specifies the file format used for collecting performance counter and trace data. You can use binary, circular binary, comma and tab separated, or SQL database formats when collecting performance counters.As others have said if you also have historical records you need to parse you can use the Relog utility to convert existing .blg files in to a more useful format.
另一种选择是将 perfmon 数据收集集导出为模板，并更改 XML 中的日志文件格式 - 查找 LogFileFormat 标记并将值更改为您偏好的格式
0 = CSV、1 = TSV、2 = SQL , 3 = 默认二进制格式。
Another option is to export the perfmon Data Collection Set as a template, and change the log file format in the XML - look for the LogFileFormat tag and change the value to the format of your preference
0 = CSV, 1 = TSV, 2 = SQL, 3 = the default binary format.
我正在寻找一种将 PerfMon 数据合并到 SIEM 中的方法，并发现让 perfmon 记录到 SQL DB（并从 SIEM 代理的 SQL 视图中读取数据）是实现此目的的最佳方法。
关于其他产品我不能说太多，但是在 LogRhythm SIEM 中，您需要一个“UDLA”（通用数据库日志适配器）日志源 - 如果您想解析/上下文化元数据，您将需要一些解析规则（即正则表达式）查询返回的内容。
看到诸如“如果有 x 个登录错误，并且可用 MBytes 小于 100，则触发警报/AIEngine 规则‘内存不足，无法处理登录’”之类的信息很有用。
这是一个相当蹩脚的例子，但你明白了。
您还可以查看其他具有潜在恶意解释和良性解释的事物。
例如 - 如果您看到大量失败的重置密码尝试，这通常可能表明存在某些恶意行为 - 但如果您看到 perfmon 计数器告诉您域控制器的可用系统 PTE 总数少于 1,000 个（诚然），则情况并非如此在 64 位操作系统上不太可能），或者 CPU 使用率超过 95%。在这种情况下，这不一定是安全问题，而是负载/容量问题 - 或者您的 DC 出现了严重问题。
I was looking for a way to incorporate PerfMon data into a SIEM, and found that getting perfmon to log to a SQL DB (and reading the data from a SQL view, from the SIEM agent) was the best way of doing this.
I can't say much about other products, but in LogRhythm SIEM, you need a "UDLA" (universal database log adapter) log source for it - and if you want to parse/contextualise the metadata, you'll need some parsing rules (ie regex) for what the query returns.
It's useful to see things like "if there's x number of logon errors, AND Avail MBytes is less than 100, THEN trigger alarm/AIEngine rule 'Insufficient Memory to Process Logons'".
That's a pretty lame example, but you get the idea.
You might also look at other things which have a potentially malicious explanation, and also a benign explanation.
For example - if you see a large amount of failed attempts to reset passwords, this might usually indicate some malicious behaviour - but not if you see the perfmon counters telling you that the Domain Controller has a total of less than 1,000 free system PTEs (admittedly unlikely on a 64-bit OS), or is seeing CPU usage of more than 95%. In which case, it's not necessarily a security issue, it's a load/capacity issue - or something is very wrong with your DC.