How to properly "merge/purge" exported windows event logs? -

-

i'm looking ideas/suggestions on how improve process de-duplicating windows event log entries in exported .evt files.

we collect exported windows logs number of machines on daily basis. these transferred separate facility archiving, analysis, etc. our process renames each log file year , day #, , archived. machine "server1", example, have each day's logs available in files this:

server1_2016_001_application.evt server1_2016_002_application.evt server1_2016_003_application.evt

...and on. each log type (system, security, others well).

in order avoid getting lots of duplication, i've been using wevtutil produce trimmed-down copies of these files so:

wevtutil epl "application.evt" "server1_2016_003_application.evt" "/q:*[system[timecreated[@systemtime>='2016-01-02t00:00:00.000z' , @systemtime<='2016-01-02t23:59:59.999z']]]" /lf:true /ow:true

but , other attempts i've made clumsy; "003" export might not have entries day 3, don't have control on when logs exported @ source. can instead process previous day's entries, there times when want/need see events right point logs exported.

so i'm trying figure out way determine last log entry in given file, next day can query events occur after entry. iow, each event log type each machine, want capture time tag, etc. of last entry , persist info disk next day, can read , use info starting point day's processing.


Comments

Post a Comment

Popular posts from this blog

ruby - Trying to change last to "x"s to 23 -

-
i have been playing around irb , have string looks this: irb(main):072:0> puts ["[\"4354 5432 5432 xxxxx\", \"6547 6547 8543 xxxxx\", \"2344 6543 6674 xxxxx\", \"2346 6236 7543 xxxxx\", \"1273 5585 5587 xxxxx\"]"] => nil irb(main):073:0> what want gsub last 2 "x" s of each 17 digit combination, 23 . what i've tried far (i've been using rubular): a.gsub(/\d[x]/,"23") <= grabs "x" s i'm close a.gsub(/\w[x{2}]/,"23") <= grabs "x" s grabs two digits each combination. is there easier way i'm not understanding? a.gsub(/\d{4} \d{4} \d{4} xxx\kxx/, '23') \d{4} = 4 digits what \k drop matched far. can use don't replace entire number, still able validate have in desired format.
Read more

jquery - Clone last and append item to closest class -

-
this bare-bones code on page: <div class="list-container"> <div class="single-list-item"> <button>remove</button> </div> <div class="single-list-item"> <button>remove</button> </div> <div class="single-list-item"> <button>remove</button> </div> </div> <p><button class="add-list-item">add</button></p> <div class="list-container"> <div class="single-list-item"> <button>remove</button> </div> <div class="single-list-item"> <button>remove</button> </div> <div class="single-list-item"> <button>remove</button> </div> </div> <p><button class="add-list-item">add</button></p> <di...
Read more

css - Can I use the :after pseudo-element on an input field? -

-
i trying use :after css pseudo-element on input field, not work. if use span , works ok. <style type="text/css"> .mystyle:after {content:url(smiley.gif);} .mystyle {color:red;} </style> this works (puts smiley after "buu!" , before "some more") <span class="mystyle">buuu!</span>a more this not work - colors somevalue in red, there no smiley. <input class="mystyle" type="text" value="somevalue"> what doing wrong? should use pseudo-selector? note: cannot add span around input , because being generated third-party control. :after , :before not supported in internet explorer 7 , under, on elements. it's not meant used on replaced elements such form elements (inputs) , image elements . in other words it's impossible pure css. however if using jquery can use $(".mystyle").after("add smiley here"); api docs on .after to ...
Read more