using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace GetDNSListTool
{
    public class EventLogEntity
    {
        string strEventType = string.Empty;
        /// <summary>
        /// 日志类型
        /// </summary>
        public string EventType
        {
            get { return strEventType; }
            set { strEventType = value; }
        }

        string strTimeWritten = string.Empty;
        /// <summary>
        /// 日志日期
        /// </summary>
        public string TimeWritten
        {
            get { return strTimeWritten; }
            set { strTimeWritten = value; }
        }

        string strCategory = string.Empty;
        /// <summary>
        /// 日志种类
        /// </summary>
        public string Category
        {
            get { return strCategory; }
            set { strCategory = value; }
        }

        string strSourceName = string.Empty;
        /// <summary>
        /// 日志来源
        /// </summary>
        public string SourceName
        {
            get { return strSourceName; }
            set { strSourceName = value; }
        }
        /// <summary>
        /// Eevnet ID
        /// </summary>
        string strEventIdentifier = string.Empty;
        public string EventIdentifier
        {
            get { return strEventIdentifier; }
            set { strEventIdentifier = value; }
        }

        string strRecordNumber = string.Empty;
        /// <summary>
        /// 行号
        /// </summary>
        public string RecordNumber
        {
            get { return strRecordNumber; }
            set { strRecordNumber = value; }
        }

        string strEventCode = string.Empty;
        /// <summary>
        /// 日志编码
        /// </summary>
        public string EventCode
        {
            get { return strEventCode; }
            set { strEventCode = value; }
        }

        string strCategoryString = string.Empty;
        /// <summary>
        /// CategoryString
        /// </summary>
        public string CategoryString
        {
            get { return strCategoryString; }
            set { strCategoryString = value; }
        }

        string strMessage = string.Empty;
        /// <summary>
        /// 详细错误
        /// </summary>
        public string Message
        {
            get { return strMessage; }
            set { strMessage = value; }
        }
    }
}

#region//格式化信息类别
       /// <summary>
       /// 格式化信息类别
       /// </summary>
       /// <param name="val"></param>
       /// <returns></returns>
       private string GetEventTypeString(NTLogEvent.EventTypeValues val)
       {
           switch (val)
           {
               case NTLogEvent.EventTypeValues.Error:
                   return EventTypeDescription.Error;
               case NTLogEvent.EventTypeValues.Warning:
                   return EventTypeDescription.Warning;
               case NTLogEvent.EventTypeValues.Information:
                   return EventTypeDescription.Information;
               case NTLogEvent.EventTypeValues.Security_audit_success:
                   return EventTypeDescription.SuccessAudit;
               case NTLogEvent.EventTypeValues.Security_audit_failure:
                   return EventTypeDescription.FailureAudit;
               default:
                   return EventTypeDescription.Unknown;
           }
       }
       #endregion

#region//获取日志文件
       /// <summary>
       /// 获取日志文件
       /// </summary>
       /// <param name="topNumber">多少条</param>
       /// <param name="eventCode">事件ID</param>
       /// <param name="startTime">开始时间</param>
       /// <param name="endTime">结束时间</param>
       /// <returns>返回集合</returns>
       public List<EventLogEntity> GetEventLogList(int topNumber, string eventCode,
           string startTime, string endTime)
       {
           List<EventLogEntity> logList = new List<EventLogEntity>();
           try
           {
               //条件语句
               StringBuilder query = new StringBuilder();
               StringBuilder strWhere = new StringBuilder();
               query.Append("select EventType, TimeWritten, Category, SourceName, EventIdentifier, RecordNumber,CategoryString,EventCode,Message  from Win32_NTLogEvent ");
               //日志ID
               if (!string.IsNullOrEmpty(eventCode))
               {
                   strWhere.Append(" AND eventCode = '");
                   strWhere.Append(eventCode);
                   strWhere.Append("'");
               }
               //开始日期
               if (!string.IsNullOrEmpty(startTime))
               {
                   strWhere.Append(" AND TimeWritten>= '");
                   strWhere.Append(getDmtfFromDateTime(startTime));
                   strWhere.Append("'");
               }
               //结束日期
               if (!string.IsNullOrEmpty(endTime))
               {
                   strWhere.Append(" AND TimeWritten<= '");
                   strWhere.Append(getDmtfFromDateTime(endTime));
                   strWhere.Append("'");
               }
               string laststrWhere = strWhere.ToString();
               //如果有检索条件
               if (!string.IsNullOrEmpty(laststrWhere))
               {
                   laststrWhere = );
               }
               //组合条件
               query.Append(laststrWhere);
               //值
               ManagementObjectCollection moCollection = null;
               //如果是本地
               if (isLocal)
               {
                   ManagementScope scope = new ManagementScope(scopePath);
                   scope.Connect();
                   ObjectQuery objectQuery = new ObjectQuery(query.ToString());
                   //WQL语句，设定的WMI查询内容和WMI的操作范围，检索WMI对象集合
                   ManagementObjectSearcher Searcher = new ManagementObjectSearcher(scope, objectQuery);
                   //异步调用WMI查询
                   moCollection = Searcher.Get();
               }
               //表示远程
               else
               {
                   //设定通过WMI要查询的内容
                   ObjectQuery Query = new ObjectQuery(query.ToString());
                   //WQL语句，设定的WMI查询内容和WMI的操作范围，检索WMI对象集合
                   ManagementObjectSearcher Searcher = new ManagementObjectSearcher(Ms, Query);
                   //异步调用WMI查询
                   moCollection = Searcher.Get();
               }
               //循环
               if (moCollection != null)
               {

                   //计数器
                   ;
                   //foreach
                   foreach (ManagementObject mObject in moCollection)
                   {
                       //如果i==topNumber就退出循环
                       if (i == topNumber)
                       {
                           break;
                       }
                       EventLogEntity eventLog = new EventLogEntity();

                       //日志类型
                       eventLog.EventType = mObject["EventType"] == null ? string.Empty :
                            GetEventTypeString(((NTLogEvent.EventTypeValues)(System.Convert.ToInt32(mObject["EventType"]))));
                       //日志种类
                       eventLog.Category = mObject["Category"] == null ? string.Empty :
                            mObject["Category"].ToString();
                       //日志种类
                       eventLog.CategoryString = mObject["CategoryString"] == null ? string.Empty :
                            mObject["CategoryString"].ToString();
                       //日志编码
                       eventLog.EventCode = mObject["EventCode"] == null ? string.Empty :
                            mObject["EventCode"].ToString();
                       //日志ID
                       eventLog.EventIdentifier = mObject["EventIdentifier"] == null ? string.Empty :
                            mObject["EventIdentifier"].ToString();
                       //行号
                       eventLog.RecordNumber = mObject["RecordNumber"] == null ? string.Empty :
                            mObject["RecordNumber"].ToString();
                       //日期
                       eventLog.TimeWritten = mObject["TimeWritten"] == null ? string.Empty :
                            getDateTimeFromDmtfDate(mObject["TimeWritten"].ToString());

                       //日志来源
                       eventLog.SourceName = mObject["SourceName"] == null ? string.Empty :
                            mObject["SourceName"].ToString();
                       //详细错误
                       eventLog.Message = mObject["Message"] == null ? string.Empty :
                           mObject["Message"].ToString();
                       //add
                       logList.Add(eventLog);
                       //
                       //
                       i++;
                   }

               }
           }
           catch (Exception ex)
           {
               throw ex;
           }
           //
           return logList;
       }
       #endregion

       #region//根据行号检索错误信息
       /// <summary>
       /// 根据行号检索错误信息
       /// </summary>
       /// <param name="recordNumber">行号</param>
       /// <returns>返回错误信息</returns>
       public string GetErrMsg(uint recordNumber)
       {
           string Msg = string.Empty;
           try
           {
               //条件语句
               StringBuilder query = new StringBuilder();
               query.Append("select Message, InsertionStrings from Win32_NTLogEvent where ");
               query.Append(" RecordNumber='");
               query.Append(recordNumber);
               query.Append("'");
               //值
               ManagementObjectCollection moCollection = null;
               //如果是本地
               if (isLocal)
               {
                   ManagementScope scope = new ManagementScope(scopePath);
                   scope.Connect();
                   ObjectQuery objectQuery = new ObjectQuery(query.ToString());
                   //WQL语句，设定的WMI查询内容和WMI的操作范围，检索WMI对象集合
                   ManagementObjectSearcher Searcher = new ManagementObjectSearcher(scope, objectQuery);
                   //异步调用WMI查询
                   moCollection = Searcher.Get();
               }
               //表示远程
               else
               {
                   //设定通过WMI要查询的内容
                   ObjectQuery Query = new ObjectQuery(query.ToString());
                   //WQL语句，设定的WMI查询内容和WMI的操作范围，检索WMI对象集合
                   ManagementObjectSearcher Searcher = new ManagementObjectSearcher(Ms, Query);
                   //异步调用WMI查询
                   moCollection = Searcher.Get();
               }
               //检索错误信息
               foreach (ManagementObject mObject in moCollection)
               {
                   //错误信息
                   string message = mObject["Message"] == null ?
                       string.Empty : mObject["Message"].ToString();
                   //错误信息
                   string[] insertionStrings =mObject["InsertionStrings"]==null?null:
                       (string[])mObject["InsertionStrings"];
                   //如果有错误信息
                   if (string.IsNullOrEmpty(message))
                   {
                       )
                       {
                           StringBuilder sb = new StringBuilder();

                           ; i < insertionStrings.Length; i++)
                           {
                               sb.Append(insertionStrings[i]);
                               sb.Append(" ");
                           }

                           Msg =  sb.ToString();
                       }

                   }
                   else
                   {
                       Msg= message;
                   }
               }
           }
           catch
           {
           }
           //return
           return string.IsNullOrEmpty(Msg) ? "无错误信息，请与管理员联系核对！" : Msg;
       }
       #endregion