#!perl -w
# This script reads data from specified Windows Event Logs and writes the information to a file
# Output is ScanLog-compatible. First this script establishes a time range by reading the specified Build Log.
# For info. on Win32::EventLog, see "Win32 Perl Programming" Page 171 et seq.
use FindBin;
use Sys::Hostname;
use Win32;
use Win32::EventLog;
use Getopt::Long;
use strict;
# For Date calculations
{
no warnings;
use lib "$FindBin::Bin/../buildsystemtools/lib"; # For running in source
}
use Date::Manip;

# Set TimeZone because Date:Manip needs it set and then tell it to IGNORE the TimeZone
&Date_Init("TZ=GMT","ConvTZ=IGNORE");

# Check if HiRes Timer is available
my $gHiResTimer = 0; #Flag - TRUE if HiRes Timer module available
if (eval "require Time::HiRes;") {
  $gHiResTimer = 1;
} else {
  print "Cannot load HiResTimer Module\n";
}

# Capture the name of this script for Help display etc.
$0 =~ m/([^\\]+?)$/;
my $gThisFile = $1;
# Process command line

my ($gComputer, $gBuildLogstart, $gBuildLogend, $gOutLogFile, @gEventSourcesUser) = ProcessCommandLine();
$gComputer = (defined $gComputer)? uc $gComputer: hostname();

# Open logfile, if specified
my $gOutLogHandle = \*OUTLOGFILE;
if (defined $gOutLogFile)
{
    open ($gOutLogHandle, ">$gOutLogFile") or die "Failed to open $gOutLogFile";
    my $iTime = gmtime(time);
    PrintStageStart(0,"Windows Event Log Extracts",$gThisFile);
    print "Logfile: $gOutLogFile  Opened: $iTime\n";
    print $gOutLogHandle "Output file: $gOutLogFile  Opened: $iTime\n";
}
else
{
    $gOutLogHandle = \*STDOUT;
    PrintStageStart(0,"Windows Event Log Extracts",$gThisFile);     # Start logging Generic Info. as pseudo Build Stage
    print "Logging to STDOUT\n";
}
print $gOutLogHandle "Data extracted from Windows Event Logs for Computer: $gComputer\n";

# Establish time range. Get build start  time from specified Build Log file.
unless (defined $gBuildLogstart)
{
    my $iMsg = "No Build Log specified";
    print $gOutLogHandle "ERROR: $iMsg\n";
    PrintStageEnd(0);     # Stop logging Generic Info.
    Usage("$iMsg");
}

unless (defined $gBuildLogend)
{
    my $iMsg = "No Build Log specified";
    print $gOutLogHandle "ERROR: $iMsg\n";
    PrintStageEnd(0);     # Stop logging Generic Info.
    Usage("$iMsg");
}


my ($gStartSecs, $gStopSecs) = GetTimeRange($gBuildLogstart, $gBuildLogend);

unless (defined $gStartSecs)
{
    my $iMsg = "Invalid Build Log: $gBuildLogstart";
    print $gOutLogHandle "ERROR: $iMsg\n";
    PrintStageEnd(0);          # Stop logging Generic Info.
    Usage("$iMsg");
}

# Establish time range. Get build  end time from specified Build Log file.
# Determine which Event Logs are to be read. Default is "All three". Specifying one only is really a debug convenience.
my @gEventSourcesDefault = ('Application','Security','System');
my @gEventSources;
if (@gEventSourcesUser)  # Event Log(s) specified by user.
{
    foreach my $iSrcU (@gEventSourcesUser)
    {
        my $iOKFlag = 0;
        foreach my $iSrcD (@gEventSourcesDefault)
        {
            if (lc $iSrcU eq lc $iSrcD)
            {
                push (@gEventSources, $iSrcD);
                $iOKFlag = 1;
                last;
            }
        }
        unless ($iOKFlag)
        {
            my $iMsg = "Invalid Event Log Filename: $iSrcU";
            print $gOutLogHandle "ERROR: $iMsg\n";
            PrintStageEnd(0);     # Stop logging Generic Info.
            Usage("$iMsg");
        }
    }   # End foreach my $iSrcU (@gEventSourcesUser)

}
else    # Default to "All logs"
{
    @gEventSources = @gEventSourcesDefault;
}

PrintStageEnd(0);     # Stop logging Generic Info.

# Finally read the required Event Log(s)
$Win32::EventLog::GetMessageText = 1;   # Ensure that we get the message content from each Event Log entry.
for (my $iIndx = 0; $iIndx < @gEventSources; )
{
    my $iEventSource=$gEventSources[$iIndx];
    ++$iIndx;
    print "Reading Event Log: $iEventSource\n";
    ReadEventLog ($iIndx,$iEventSource);
}

close OUTLOGFILE;
exit (0);

# ReadEventLog
#
# Read from one Event Log and output to supplied logfile handle.
#
# Input: Stage Number, Event Log Name
#
# Output: ScanLog-compatible data to log file
#
sub ReadEventLog
{
    my $iStage = shift;         # Stage number.
    my $iEventSource = shift;   # Name of Event Log file.
    # First argument to "new Win32::EventLog()" may be "Application", "Security" or "System";
    my $iTotalEvents;
    my $iSeparator = "------------------------------------------------------------\n";
    PrintStageStart($iStage,"Windows $iEventSource Event Log Extracts",$gThisFile);

    my $iEventObject = new Win32::EventLog($iEventSource, $gComputer);

    unless ($iEventObject)
    {
        print $gOutLogHandle  "ERROR: Failed to open Event Log: $iEventSource\n";
        PrintStageEnd($iStage);
        return;
    }

    unless ($iEventObject->GetNumber($iTotalEvents))
    {
        print $gOutLogHandle  "ERROR: Cannot read Event Log: $iEventSource\n";
        PrintStageEnd($iStage);
        return;
    }

    unless ($iTotalEvents)    # Check number of events in log.
    {
        print $gOutLogHandle "No event recorded in $iEventSource Log.\n";
    }
    else
    {
        # Reading Flags: EVENTLOG_FORWARDS_READ, EVENTLOG_BACKWARDS_READ, EVENTLOG_SEQUENTIAL_READ, EVENTLOG_SEEK_READ
        my $iFlag = EVENTLOG_BACKWARDS_READ | EVENTLOG_SEQUENTIAL_READ;
        my $iRecNum = 0;     # Ignored unless $iFlag == EVENTLOG_SEEK_READ
        my $iStopFlag = 0;
        my $count = 0;
        while (!$iStopFlag)
        {
            my %iHash;
            unless ($iEventObject->Read($iFlag, $iRecNum, \%iHash))
            {
                $iStopFlag = 1;
            }
            else    # Successful "read"
            {
            my $iEventTime = $iHash{TimeGenerated};
            if ($iEventTime > $gStopSecs)
                { next; }
            if ($iEventTime < $gStartSecs)
                { last; }
            ++$count;
            print $gOutLogHandle $iSeparator;
            # Supported Event Types: EVENTLOG_ERROR_TYPE, EVENTLOG_WARNING_TYPE, EVENTLOG_INFORMATION_TYPE, EVENTLOG_AUDIT_SUCCESS, EVENTLOG_AUDIT_FAILURE
            my $iTxt;
            if ($iHash{EventType} == EVENTLOG_ERROR_TYPE)
                {$iTxt = 'Error'; }
            elsif ($iHash{EventType} == EVENTLOG_WARNING_TYPE)
                {$iTxt = 'Warning'; }
            elsif ($iHash{EventType} == EVENTLOG_INFORMATION_TYPE)
                {$iTxt = 'Information'; }
            elsif ($iHash{EventType} == EVENTLOG_AUDIT_SUCCESS)
                {$iTxt = 'Audit Success'; }
            elsif ($iHash{EventType} == EVENTLOG_AUDIT_FAILURE)
                {$iTxt = 'Audit Failure'; }
            else
                {$iTxt = "*unknown* [$iHash{EventType}]"; }
            print $gOutLogHandle "EventType: $iTxt  Source: $iHash{Source}  RecNum: $iHash{RecordNumber}\n";
            my $iTimeStr = gmtime($iHash{TimeGenerated});
            print $gOutLogHandle "TimeGen:   $iHash{TimeGenerated} ($iTimeStr)\n";
            print $gOutLogHandle "Computer:  $iHash{Computer}\n";
            print $gOutLogHandle "User:      $iHash{User}\n";
            print $gOutLogHandle "EventID:   $iHash{EventID}\n";
            print $gOutLogHandle "Category:  $iHash{Category}\n";
            $iTxt = (defined $iHash{Message})? $iHash{Message}: '*none*';
            print $gOutLogHandle "Message:   $iTxt\n";
            $iTxt = ($iHash{Strings})? $iHash{Strings}: '*none*';
            print $gOutLogHandle "Strings:   $iTxt\n";
            }
        }   # End while (!$iStopFlag)
        print $gOutLogHandle $iSeparator;
        print $gOutLogHandle "Events in specified time range = $count    Events in file = $iTotalEvents\n";
    }   # End unless ($iTotalEvents)
    PrintStageEnd($iStage);
}

# PrintStageStart
#
# Print to log file the ScanLog-Compatible lines to start a stage
#
# Input: Stage, Component Name [,Command Name]
#
# Output: Start time etc.
#
sub PrintStageStart
{
    my $iStage = shift;         # Stage number.
    my $iComponent = shift;     # e.g. Name of Event Log file.
    my $iCommand = shift;
    my $iTime = gmtime(time);
    print $gOutLogHandle "===-------------------------------------------------\n";
    print $gOutLogHandle "=== Stage=$iStage\n";
    print $gOutLogHandle "===-------------------------------------------------\n";
    print $gOutLogHandle "=== Stage=$iStage started $iTime\n";
    print $gOutLogHandle "=== Stage=$iStage == $iComponent\n";
    if (defined $iCommand)
    {
        print $gOutLogHandle "-- $iCommand\n";
    }
    print $gOutLogHandle "++ Started at $iTime\n";

    if ($gHiResTimer)
    {
        print $gOutLogHandle "+++ HiRes Start ".Time::HiRes::time()."\n";
    }
}

# PrintStageEnd
#
# Print to log file the ScanLog-Compatible lines to end a stage
#
# Input: Stage
#
# Output: End time etc.
#
sub PrintStageEnd
{
    my $iStage = shift;         # Stage number.
    if ($gHiResTimer)
    {
        print $gOutLogHandle "+++ HiRes End ".Time::HiRes::time()."\n";
    }
    my $iTime = gmtime(time);
    print $gOutLogHandle "++ Finished at $iTime\n";
    print $gOutLogHandle "=== Stage=$iStage finished $iTime\n";
}

#sub GetTimeRange
#
# Establish start and end times for overall build
# Typical start line: === Stage=1 started Mon Oct  4 15:55:31 2004
# Typical end line:   === Stage=115 finished Tue Oct  5 01:47:37 2004
#
# Input: Name of Build Log File to read
#
# Output: Summary timing info to log file
#
# Return: Start/End times in seconds
#
sub GetTimeRange
{

    my ($iBuildLogstart,$iBuildLogend) = @_;

    my ($iStartTime, $iStopTime);
    
# $iStartTime Time read from $iBuildLogstart
    unless (open (INLOGFILE, "<$iBuildLogstart"))
    {
        print $gOutLogHandle "Failed to open input file: $iBuildLogstart\n";
        return undef, undef;
    }
    while(my $iLine = <INLOGFILE>)
    {
        chomp $iLine;
        unless (defined $iStartTime)
        {
            if ($iLine =~ m/^===\s+Stage=\S*\s+started\s+(.+)/)
                { $iStartTime = $1; last; }
        }
    }
    close INLOGFILE;

# $iStopTime Time read from $iBuildLogend

    unless (open (OUTFILE, "<$iBuildLogend"))
    {
        print $gOutLogHandle "Failed to open input file: $iBuildLogend\n";
        return undef, undef;
    }
    while(my $iLine = <OUTFILE>)
    {
        chomp $iLine;
        if (($iLine =~ m/^===\s(.*\s)?finished\s+(.+)/))
            { $iStopTime = $2; }
    }
    close OUTFILE;

    my $iDate = ParseDateString($iStartTime);
    my $iStartSecs = UnixDate($iDate,"%s");

    print $gOutLogHandle "Time range taken for Build start time from Build Log: $iBuildLogstart\n";
    print $gOutLogHandle "Earliest Event: $iStartTime\n\n";

    $iDate = ParseDateString($iStopTime);
    my $iStopSecs = UnixDate($iDate,"%s");

    print $gOutLogHandle "Time range taken for Build end time from Build Log: $iBuildLogend\n";
    print $gOutLogHandle "Latest Event: $iStopTime\n\n";

    my $iSecs = $iStopSecs - $iStartSecs;
    my $iMins = int ($iSecs/60);
    $iSecs %= 60;
    my $iHours = int($iMins/60);
    $iMins %= 60;
    printf $gOutLogHandle "--Time Range between the build START and FINISH:<< %d:%02d:%02d>>\n\n",$iHours,$iMins,$iSecs;

    return $iStartSecs, $iStopSecs;
}


# ProcessCommandLine
#
# Process Commandline. On error, call Usage()
#
# Input: None
#
# Return: Parameters as strings.
#
sub ProcessCommandLine
{

  my ($iHelp, $iComputer, $iBuildLogstart, $iBuildLogend , $iOutFile, @iEventSources);
  GetOptions('h' => \$iHelp, 'c=s' => \$iComputer, 'l=s' => \$iBuildLogstart,'k=s'=> \$iBuildLogend, 'o=s' => \$iOutFile, 's=s' => \@iEventSources);

  if ($iHelp)
  {
    Usage();
  }
  else
  {
    return ($iComputer, $iBuildLogstart, $iBuildLogend,$iOutFile, @iEventSources);
  }
}


# Usage: Display Help and exits script.
#
# Input: Error message, if any
#
# Output: Usage information.
#
# Return: Never returns. Exits with non-zero errorlevel
#
sub Usage
{
    if (@_)
    {
        print "\nERROR: @_\n";
    }

    print <<USAGE_EOF;

    $gThisFile:
      Reads the Windows Event Logs for the specified computer.
      The time range is established by reading the specified Build Log.
      ScanLog-compatible output is written to specified logfile.

    Usage: $gThisFile parameters [options]

    Parameters:
      -l  Build start Log file
      -k  Build End Log file

    Options:
      -h  Help
      -c  Computer name (defaults to local PC)
      -o  Logfile for output (defaults to STDOUT)
      -s  Event Log Source (defaults to "All")
          (Supported logs: "Application", "Security" or "System")


USAGE_EOF

    exit 1;
}

__END__