我正在尝试解析几百个未使用SNARE，NXlog或Adiscon格式化的Windows事件日志（我不确定它们是如何将它们发送到syslog服务器的）。
我遇到的问题是确定通过多行，多标签的Windows事件文件解析的最佳/最有效的方法。我没有相应的EVTX文件（它只是一个日志文件）。
我的目标是将每个事件放在一行上，没有选项卡，以便我可以使用grep和awk更轻松地解析它。
tr -d "\n\r" < windows.log获取一行上的所有内容（删除换行符），现在我需要删除标签（标签不如新行重要），并找出每次在“Jan 14”之前添加新行的方法。
使用Python，Perl或Powershell可能有更好的方法来做到这一点，但我的经验有限。
示例日志文件：
Jan 14 00:00:02 server.host.com MSWinEventLog 5 Security 22159648 Sun Jan 13 23:59:35 2019 4634 Microsoft-Windows-Security-Auditing N/A Audit Success server.host.com 12545 An account was logged off.
Subject:
Security ID: S-1-5-21-3015042641-2194367929-112691256-2051
Account Name: SVCACCT
Account Domain: MYDOMAIN
Logon ID: 0xD7FC64F5
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Jan 14 00:00:02 server.host.com MSWinEventLog 5 Security 22159649 Sun Jan 13 23:59:35 2019 4634 Microsoft-Windows-Security-Auditing N/A Audit Success server.host.com 12545 An account was logged off.
Subject:
Security ID: S-1-5-21-3015042641-2194367929-112691256-12106
Account Name: SVCACCT2
Account Domain: MYDOMAIN
Logon ID: 0xD7FC600A
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
压缩的示例日志文件：
Jan 14 00:00:02 server.host.com MSWinEventLog 5 Security 22159648 Sun Jan 13 23:59:35 2019 4634 Microsoft-Windows-Security-Auditing N/A Audit Success server.host.com 12545 An account was logged off. Subject: Security ID: S-1-5-21-3015042641-2194367929-112691256-2051 Account Name: SVCACCT Account Domain: MYDOMAIN Logon ID: 0xD7FC64F5 Logon Type: 3 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Jan 14 00:00:02 server.host.com MSWinEventLog 5 Security 22159648 Sun Jan 13 23:59:35 2019 4634 Microsoft-Windows-Security-Auditing N/A Audit Success server.host.com 12545 An account was logged off. Subject: Security ID: S-1-5-21-3015042641-2194367929-112691256-2051 Account Name: SVCACCT2 Account Domain: MYDOMAIN Logon ID: 0xD7FC64F5 Logon Type: 3 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
首先，我们删除所有控制字符。然后我们搜索“Jan 14”并在它之前添加换行符。最后，我们使用tr标志调用-s，该标志用单个字符替换重复字符的实例。我不太确定这是多么有效，但它可能会让你开始。
tr -d "[:cntrl:]" < windows.log | sed 's/Jan 14/\'$'\n&/g' | tr -s " "
结果
Jan 14 00:00:02 server.host.com MSWinEventLog 5 Security 22159648 Sun Jan 13 23:59:35 2019 4634 Microsoft-Windows-Security-Auditing N/A Audit Success server.host.com 12545 An account was logged off.Subject: Security ID: S-1-5-21-3015042641-2194367929-112691256-2051 Account Name: SVCACCT Account Domain: MYDOMAIN Logon ID: 0xD7FC64F5Logon Type: 3This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Jan 14 00:00:02 server.host.com MSWinEventLog 5 Security 22159649 Sun Jan 13 23:59:35 2019 4634 Microsoft-Windows-Security-Auditing N/A Audit Success server.host.com 12545 An account was logged off.Subject: Security ID: S-1-5-21-3015042641-2194367929-112691256-12106 Account Name: SVCACCT2 Account Domain: MYDOMAIN Logon ID: 0xD7FC600ALogon Type: 3This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
而不是试图将每条记录压缩到1行然后尝试分析它，只需将每个12行块作为单个记录处理。例如：
$ cat tst.awk
{
gsub(/\r/,"")
gsub(/^[[:space:]]+|[[:space:]]+$/,"")
lineNr = (NR - 1) % 12 + 1
}
lineNr == 1 {
f["hd"] = $0
}
lineNr ~ /[45679]/ {
tag = val = $0
sub(/:.*/,"",tag)
sub(/[^:]+:[[:space:]]*/,"",val)
f[tag] = val
}
lineNr == 11 {
f["tl"] = $0
for (tag in f) {
print tag, "=", f[tag]
}
print "-------"
}
.
$ awk -f tst.awk file
tl = This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Logon ID = 0xD7FC64F5
Logon Type = 3
Account Name = SVCACCT
Security ID = S-1-5-21-3015042641-2194367929-112691256-2051
hd = Jan 14 00:00:02 server.host.com MSWinEventLog 5 Security 22159648 Sun Jan 13 23:59:35 2019 4634 Microsoft-Windows-Security-Auditing N/A Audit Success server.host.com 12545 An account was logged off.
Account Domain = MYDOMAIN
-------
tl = This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Logon ID = 0xD7FC600A
Logon Type = 3
Account Name = SVCACCT2
Security ID = S-1-5-21-3015042641-2194367929-112691256-12106
hd = Jan 14 00:00:02 server.host.com MSWinEventLog 5 Security 22159649 Sun Jan 13 23:59:35 2019 4634 Microsoft-Windows-Security-Auditing N/A Audit Success server.host.com 12545 An account was logged off.
Account Domain = MYDOMAIN
-------
使用这种方法，您可以简单地通过它的名称来引用每个字段进行打印或分析。您可以扩展上述内容，将第一行的所有单独字段映射到单独的标记/值，例如
lineNr==1 {
f["timestamp"] = $1 " " $2 " " $3
...
}
或与正则表达式匹配或任何有意义的。一旦你完成上述操作，在脚本的其余部分分析或打印任何你喜欢的东西变得非常简单。