def testParse(self):
"""Tests the Parse function."""
parser = winevt.WinEvtParser()
storage_writer = self._ParseFile(['SysEvent.Evt'], parser)
# Windows Event Log (EVT) information:
# Version : 1.1
# Number of records : 6063
# Number of recovered records : 438
# Log type : System
self.assertEqual(storage_writer.number_of_events, (6063 + 438) * 2)
self.assertEqual(storage_writer.number_of_extraction_warnings, 0)
self.assertEqual(storage_writer.number_of_recovery_warnings, 0)
events = list(storage_writer.GetEvents())
expected_event_values = {
'date_time': '2011-07-27 06:41:47',
'timestamp_desc': definitions.TIME_DESCRIPTION_CREATION
}
self.CheckEventValues(storage_writer, events[0], expected_event_values)
# Event number : 1392
# Creation time : Jul 27, 2011 06:41:47 UTC
# Written time : Jul 27, 2011 06:41:47 UTC
# Event type : Warning event (2)
# Computer name : WKS-WINXP32BIT
# Source name : LSASRV
# Event category : 3
# Event identifier : 0x8000a001 (2147524609)
# Number of strings : 2
# String: 1 : cifs/CONTROLLER
# String: 2 : "The system detected a possible attempt to compromise
# security. Please ensure that you can contact the
# server that authenticated you.\r\n (0xc0000388)"
expected_string2 = (
'"The system detected a possible attempt to compromise security. '
'Please ensure that you can contact the server that authenticated you.'
'\r\n (0xc0000388)"')
expected_event_values = {
'computer_name': 'WKS-WINXP32BIT',
'date_time': '2011-07-27 06:41:47',
'data_type': 'windows:evt:record',
'event_category': 3,
'event_identifier': 40961,
'event_type': 2,
'record_number': 1392,
'severity': 2,
'source_name': 'LSASRV',
'strings': ['cifs/CONTROLLER', expected_string2],
'timestamp_desc': definitions.TIME_DESCRIPTION_WRITTEN
}
self.CheckEventValues(storage_writer, events[1], expected_event_values)
def testParse(self):
"""Tests the Parse function."""
parser = winevt.WinEvtParser()
storage_writer = self._ParseFile(['SysEvent.Evt'], parser)
# Windows Event Log (EVT) information:
# Version : 1.1
# Number of records : 6063
# Number of recovered records : 437
# Log type : System
self.assertEqual(storage_writer.number_of_events, (6063 + 437) * 2)
events = list(storage_writer.GetEvents())
event = events[0]
expected_timestamp = timelib.Timestamp.CopyFromString(
'2011-07-27 06:41:47')
self.assertEqual(event.timestamp, expected_timestamp)
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_CREATION)
event = events[1]
# Event number : 1392
# Creation time : Jul 27, 2011 06:41:47 UTC
# Written time : Jul 27, 2011 06:41:47 UTC
# Event type : Warning event (2)
# Computer name : WKS-WINXP32BIT
# Source name : LSASRV
# Event category : 3
# Event identifier : 0x8000a001 (2147524609)
# Number of strings : 2
# String: 1 : cifs/CONTROLLER
# String: 2 : "The system detected a possible attempt to compromise
# security. Please ensure that you can contact the
# server that authenticated you.\r\n (0xc0000388)"
self.assertEqual(event.record_number, 1392)
self.assertEqual(event.event_type, 2)
self.assertEqual(event.computer_name, 'WKS-WINXP32BIT')
self.assertEqual(event.source_name, 'LSASRV')
self.assertEqual(event.event_category, 3)
self.assertEqual(event.event_identifier, 40961)
self.assertEqual(event.strings[0], 'cifs/CONTROLLER')
expected_string = (
'"The system detected a possible attempt to compromise security. '
'Please ensure that you can contact the server that authenticated you.'
'\r\n (0xc0000388)"')
self.assertEqual(event.strings[1], expected_string)
expected_timestamp = timelib.Timestamp.CopyFromString(
'2011-07-27 06:41:47')
self.assertEqual(event.timestamp, expected_timestamp)
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_WRITTEN)
expected_message = (
'[40961 / 0xa001] '
'Severity: Warning '
'Record Number: 1392 '
'Event Type: Information event '
'Event Category: 3 '
'Source Name: LSASRV '
'Computer Name: WKS-WINXP32BIT '
'Strings: [\'cifs/CONTROLLER\', '
'\'"The system detected a possible attempt to '
'compromise security. Please ensure that you can '
'contact the server that authenticated you. (0xc0000388)"\']')
expected_short_message = (
'[40961 / 0xa001] '
'Strings: [\'cifs/CONTROLLER\', '
'\'"The system detected a possibl...')
self._TestGetMessageStrings(event, expected_message, expected_short_message)
def setUp(self):
"""Makes preparations before running an individual test."""
self._parser = winevt.WinEvtParser()
def setUp(self):
"""Sets up the needed objects used throughout the test."""
pre_obj = event.PreprocessObject()
self._parser = winevt.WinEvtParser(pre_obj, None)
def setUp(self):
"""Sets up the needed objects used throughout the test."""
self._parser = winevt.WinEvtParser()
def testParse(self):
"""Tests the Parse function."""
parser_object = winevt.WinEvtParser()
test_file = self._GetTestFilePath([u'SysEvent.Evt'])
event_queue_consumer = self._ParseFile(parser_object, test_file)
event_objects = self._GetEventObjectsFromQueue(event_queue_consumer)
# Windows Event Log (EVT) information:
# Version : 1.1
# Number of records : 6063
# Number of recovered records : 437
# Log type : System
self.assertEqual(len(event_objects), (6063 + 437) * 2)
# Event number : 1392
# Creation time : Jul 27, 2011 06:41:47 UTC
# Written time : Jul 27, 2011 06:41:47 UTC
# Event type : Warning event (2)
# Computer name : WKS-WINXP32BIT
# Source name : LSASRV
# Event category : 3
# Event identifier : 0x8000a001 (2147524609)
# Number of strings : 2
# String: 1 : cifs/CONTROLLER
# String: 2 : "The system detected a possible attempt to compromise
# security. Please ensure that you can contact the
# server that authenticated you.\r\n (0xc0000388)"
event_object = event_objects[1]
self.assertEqual(event_object.record_number, 1392)
self.assertEqual(event_object.event_type, 2)
self.assertEqual(event_object.computer_name, u'WKS-WINXP32BIT')
self.assertEqual(event_object.source_name, u'LSASRV')
self.assertEqual(event_object.event_category, 3)
self.assertEqual(event_object.event_identifier, 40961)
self.assertEqual(event_object.strings[0], u'cifs/CONTROLLER')
expected_string = (
u'"The system detected a possible attempt to compromise security. '
u'Please ensure that you can contact the server that authenticated you.'
u'\r\n (0xc0000388)"')
self.assertEqual(event_object.strings[1], expected_string)
event_object = event_objects[0]
expected_timestamp = timelib.Timestamp.CopyFromString(
u'2011-07-27 06:41:47')
self.assertEqual(event_object.timestamp, expected_timestamp)
self.assertEqual(event_object.timestamp_desc,
eventdata.EventTimestamp.CREATION_TIME)
event_object = event_objects[1]
expected_timestamp = timelib.Timestamp.CopyFromString(
u'2011-07-27 06:41:47')
self.assertEqual(event_object.timestamp, expected_timestamp)
self.assertEqual(event_object.timestamp_desc,
eventdata.EventTimestamp.WRITTEN_TIME)
expected_msg = (
u'[40961 / 0xa001] '
u'Severity: Warning '
u'Record Number: 1392 '
u'Event Type: Information event '
u'Event Category: 3 '
u'Source Name: LSASRV '
u'Computer Name: WKS-WINXP32BIT '
u'Strings: [\'cifs/CONTROLLER\', '
u'\'"The system detected a possible attempt to '
u'compromise security. Please ensure that you can '
u'contact the server that authenticated you. (0xc0000388)"\']')
expected_msg_short = (u'[40961 / 0xa001] '
u'Strings: [\'cifs/CONTROLLER\', '
u'\'"The system detected a possibl...')
self._TestGetMessageStrings(event_object, expected_msg,
expected_msg_short)