Re: Parsing logs from Windows Event logs

You will need to run a script action.  Here is a script we have for a similar use:

'Script to take the account locked out event logs, build a data dictionary, publish to a web page, check for unlocks and expire the events.

''Sample data

'2012-11-30 08:52:25,Local1.Notice,DOMAINCONTROLLER.domain.local,"Nov 30 08:52:25 DOMAINCONTROLLER MSWinEventLog 5 Security 25335525 Fri Nov 30 08:52:22 2012 644 Security NT AUTHORITY\SYSTEM N/A Audit SuccessDOMAINCONTROLLER 7 User Account Locked Out:

'

' Target Account Name: USERNAME

'

' Target Account ID: %{S-1-5-21-35927030-1879076691-1865945288-67345}

'

' Caller Machine Name: USERCOMPUTER

'

' Caller User Name: DOMAINCONTROLLER$

'

' Caller Domain: DOMAIN

'

' Caller Logon ID: (0x0,0x3E7)"

Function Main()

Dim Connection

Dim Recordset

Dim SQL

vDate = "'" & Fields.VarDate & "'"

vTime = "'" & Fields.VarTime & "'"

vPeerAddress = "'" & Fields.VarPeerAddress & "'"

'SQL statement that queries the database for open events

SQLAcctLocks = "select * from kiwilogs.Syslog_AcctLocks where LockCleared is null"

SQLAcctLocksInsert = "INSERT INTO Syslog_AcctLocks (MsgDate,MsgTime,MsgPriority,MsgHostname,MsgText) VALUES (VDate,vtime,'Local1.Notice',vPeerAddress,'This is a test message from Kiwi Syslog Server')

'create an instance of the ADO connection and recordset objects

Set ConnectionAcctLocks = CreateObject("ADODB.Connection")

Set RecordsetAcctLocks = CreateObject("ADODB.Recordset")

'open the connection to the kiwi database

ConnectionAcctLocks.Open "DSN=kiwilogs"

'Open the recordset object executing the SQL statement and return records

RecordsetAcctLocks.Open SQLAcctLocks,ConnectionAcctLocks

CleanMsg = Fields.VarCleanMessageText

arrSplits = split(CleanMsg, chr(13))

arrSplitsMsg = split(arrSplits(0), chr(9))

if instr(arrSplits(0), "User Account Locked Out") > 0 then

  arrTargetAcctName = split(arrSplits(2), ":")

  arrCallerMachineName = split(arrSplits(6), ":")

  arrCallerUserName = split(arrSplits(8), ":")

  Fields.VarCleanMessageText = trim(replace(arrSplitsMsg(12),":","")) + "," + trim(arrTargetAcctName(1)) + "," + trim(arrCallerMachineName(1)) + "," + trim(arrCallerUserName(1))

elseif instr(arrSplits(0), "User Account Unlocked") > 0 then

  arrTargetAcctName = split(arrSplits(2), ":")

  'arrCallerMachineName = split(arrSplits(6), ":")

  arrCallerUserName = split(arrSplits(8), ":")

  Fields.VarCleanMessageText = trim(replace(arrSplitsMsg(12),":",""))  + "," + trim(arrTargetAcctName(1)) + "," + trim(arrCallerUserName(1))

  end if

Main = "OK"

End Function