Python WMI 名字问题

发布于 2024-10-20 01:23:11 字数 422 浏览 1 评论 0原文

我无法使用 WMI 查询日志“Security”。其他日志工作正常。这是我使用的：

import wmi
c = wmi.GetObject(r"winmgmts:{impersonationLevel=delegate,(Security)}!\\.\root\cimv2")
for i in c.ExecQuery("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security'"):
    print i

它返回空结果，并在安全日志中创建记录“审核失败”。正如我所提到的，我可以查询所有其他日志，但不能查询特定的日志。所以我猜问题出在

c = wmi.GetObject(这里有一个问题)

原文

I can not query log "Security" using WMI. Other logs works fine. Here is what i use:

import wmi
c = wmi.GetObject(r"winmgmts:{impersonationLevel=delegate,(Security)}!\\.\root\cimv2")
for i in c.ExecQuery("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security'"):
    print i

It return me empty result, and in security log create reacord "audit failed". As i mentioned, i can query all other logs, but not this one specific.
so i guess problem is in

c = wmi.GetObject(here is a problem)

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

梦在深巷 2024-10-27 01:23:11

您是否考虑过采用 win32evtlog 方式？这是我过去使用过的一部分，它似乎工作得很好...

import win32evtlog

outfile = open('NTLog.log', 'w')
server = 'SERVER_Name'
logtype = 'Security'
hand = win32evtlog.OpenEventLog(server, logtype)
flags = win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ
total = win32evtlog.GetNumberOfEventLogRecords(hand)
count = 0
while count != total:
    events = win32evtlog.ReadEventLog(hand, flags,0)
    if events:
        for event in events:
            data = event.StringInserts
            if data:
                outfile.write(data[0])

这并不是一个真正完整的实现，但希望它能让您回到正轨！

Have you considered going the win32evtlog way? This is part of what I have used in the past and it seems to work well...

import win32evtlog

outfile = open('NTLog.log', 'w')
server = 'SERVER_Name'
logtype = 'Security'
hand = win32evtlog.OpenEventLog(server, logtype)
flags = win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ
total = win32evtlog.GetNumberOfEventLogRecords(hand)
count = 0
while count != total:
    events = win32evtlog.ReadEventLog(hand, flags,0)
    if events:
        for event in events:
            data = event.StringInserts
            if data:
                outfile.write(data[0])

This isn't really a complete implementation, but hopefully it gets you back on track!

回复收藏 0 原文

~没有更多了~