//---------------------------------------------------------------------------- // // Copyright (c) Intel Corporation, 2009-2014 All Rights Reserved. // // File: LogEventFunctionality.cs // // Contents: Example that shows how to use event log High Level API // // Notes: // //---------------------------------------------------------------------------- using System; using Intel.Manageability; using Intel.Manageability.Exceptions; using Intel.Manageability.Events; using System.Collections.Generic; using System.Linq; namespace EventLogSample { public class LogEventFunctionality { public static void RegisterToLog(IAMTInstance amt) { try { //----------------------------------------------------------------------------------------------------- // #1 - Register events so that they will be logged in the event log by using filter name (type string) // Use a filter name from the "Event" class //----------------------------------------------------------------------------------------------------- //Register events using the event string from Events class, which contains strings of the filter names. amt.Events.Log.RegisterToLog(Events.Battery.All_Battery_Events); Console.WriteLine("\nFirst RegisterToLog operation completed successfully"); } catch (ManageabilityException ex) { Console.WriteLine("Attempt to register filter with filter's name (type string) failed.\n" + "Failure reason: {0}", ex.Message); } try { //----------------------------------------------------------------------------------------------- //#2 Register events using Filter object //----------------------------------------------------------------------------------------------- //Register events with Filter object, which contains the values that define //the desired events to be logged to the event log. //Create new filter: Filter filter = new Filter(255, 4, 18, 254, 0, 150, 0, 0, 44, 255); //Register events with the filter amt.Events.Log.RegisterToLog(filter); Console.WriteLine("\nSecond RegisterToLog operation completed successfully"); } catch (ManageabilityException ex) { Console.WriteLine("Attempt to register events with Filter object failed.\n" + "Failure reason: {0}", ex.Message); } } public static void UnRegisterToLog(IAMTInstance amt) { bool error = false; try { //----------------------------------------------------------------------------------------------- //Unegister events using filter name (type string) from the "Event" class (registered in step #1) //----------------------------------------------------------------------------------------------- //Unegister events with received event string from Events class, which contains strings of the filter names. amt.Events.Log.UnRegisterToLog(Events.Battery.All_Battery_Events); } catch (ManageabilityException ex) { Console.WriteLine("Attempt to Unregister filter with filter's name (type string) failed.\n" + "Failure reason: {0}", ex.Message); error = true; } try { //----------------------------------------------------------------------------------------------- //Unregister event policy, using PolicyId = 44, which was the policy defined in step #2 //----------------------------------------------------------------------------------------------- //To register events with PolicyId, need to make sure that the Filter exists. //If the filter with this PolicyId does not exist, create new Filter with the desired PolicyId. //Unregister event policy, in case that the PolicyId of the filter is known to the user. amt.Events.Log.UnRegisterToLog(44); } catch (ManageabilityException ex) { Console.WriteLine("Attempt to unregister event log policy with PolicyId failed.\n" + "Failure reason: {0}", ex.Message); error = true; } if(!error) Console.WriteLine("\nUnRegisterToLog operation completed successfully"); } public static void ClearLog(IAMTInstance amt) { int percentageLog; try { //Get the percentage of log entries. percentageLog = amt.Events.Log.GetPercentageLog(); } catch (ManageabilityException ex) { throw ex; } if (percentageLog > 90) { //If the log is frozen, modifications are not allowed and log records cannot be deleted. if (amt.Events.Log.IsLogFrozen() == false) { try { amt.Events.Log.ClearLog(); Console.WriteLine("\nClearLog operation completed successfully"); } catch (ManageabilityException ex) { Console.WriteLine("Attempt to clear the entire log failed.\n" + "Failure reason: {0}", ex.Message); } } else { Console.WriteLine("Can not clear the log when it is frozen."); } } else { Console.WriteLine("There is no need to clear the log. Percentage of log entries is: {0}", percentageLog); } } public static void FreezeLog(IAMTInstance amt) { try { //Freeze the event log. amt.Events.Log.FreezeLog(true); Console.WriteLine("\nFreezeLog operation completed successfully"); } catch (ManageabilityException ex) { Console.WriteLine("Attempt to Freeze the log failed.\n" + "Failure reason: {0}", ex.Message); } } public static void UnFreezeLog(IAMTInstance amt) { //Unfreeze the event log. try { amt.Events.Log.FreezeLog(false); Console.WriteLine("\nUnFreezeLog operation completed successfully"); } catch (ManageabilityException ex) { Console.WriteLine("Attempt to unfreeze the log failed.\n" + "Failure reason: {0}", ex.Message); } } public static void GetRecords(IAMTInstance amt, uint identifier, uint num) { //Defined array from Record type. IEnumerable log = new List(); try { //Get the all the records from the log into the array named "log". log = amt.Events.Log.GetRecords(identifier, num); } catch (ManageabilityException ex) { Console.WriteLine("Attempt to get the specific records from the log failed.\n" + ex.Message); } parseLog(log, (int)identifier); } public static void GetAllRecords(IAMTInstance amt) { //Defined array from Record type. IEnumerable log = new List(); try { //Get the all the records from the log into the array named "log". log = (IEnumerable)amt.Events.Log.GetAllRecords(); } catch (ManageabilityException ex) { Console.WriteLine("Attempt to get the records from the log failed.\n" + "Failure reason: {0}", ex.Message); } parseLog(log, 0); } private static void parseLog(IEnumerable log, int start) { if (log.Count() != 0) { //------------------------------ //#1 Filter records, using LINQ, by timestamp. //------------------------------ //Select the records from the last day. IEnumerable query = from r in log where DateTime.Compare(r.TimeStamp, DateTime.Today.AddDays(-1)) >= 0 select r; //Print the records PrintRecords(query, start); //------------------------------ //#2 Filter records, using LINQ, by Severity. //------------------------------ //Select the records where the severity is "Information", //using the value in the id. query = from r in log where r.Severity.Id == 255 select r; //Print the records PrintRecords(query, start); //------------------------------ //#3 Filter records, using LINQ, by Entity. //------------------------------ //Select the records where the Entity is "Bios", //using Entity.Description property. query = from r in log where r.Entity.Description == "Peripheral Bay" select r; //Print the records PrintRecords(query, start); //------------------------------ //#4 Filter records, using LINQ, by Sensor Type //------------------------------ //Select the records where the Sensor Type is "AMT_Agent_Presence", //using enum "Entity". query = from r in log where r.Entity.Id == 1 select r; //Print the records. PrintRecords(query, start); //------------------------------ //#5 Filter records, using LINQ, by Message. //------------------------------ //Select the records where the Message is "AMT_Password_Attack". query = from r in log where r.Message == "AMT_Password_Attack" select r; //Print the records PrintRecords(query, start); //------------------------------ //#6 Filter records, using LINQ, by EventOffset.Description property. //------------------------------ //Select the records where the EventOffset.Description is "Lower Non-critical - going low". //This value appears when EventType = 1 and EventOffset = 1. query = from r in log where r.EventOffset.Description == "Lower Non-critical - going low" select r; //Print the records PrintRecords(query, start); //------------------------------ //#7 Filter records, using LINQ, by SensorType.Id property. //------------------------------ //Select the records where the EventOffset.Id is 3. (stands for "Voltage") query = from r in log where r.SensorType.Id == 3 select r; //Print the records PrintRecords(query, start); } else { Console.WriteLine("There are no records in the log"); } } public static void CurrentNumberOfRecord(IAMTInstance amt) { try { Console.WriteLine("Current number of records in the log: {0}", amt.Events.Log.GetCurrentNumberOfRecords()); } catch (ManageabilityException ex) { Console.WriteLine("Failed to get current number of records. Failure reason: {0}", ex.Message); } } private static void PrintRecords(IEnumerable query, int startFrom) { //Give template id to record. int numRecord = startFrom; //Print the records foreach (Record record in query) { //Console.WriteLine("Record Id | Timestamp | Severity | Sensor Type | Entity | Message | "); //string byteString = Convert.ToString(bytes[ctr], 2); //byteString = new String('0', 8 - byteString.Length) + byteString; //_binarString += byteString; Console.WriteLine("record number: {0}", numRecord++); Console.WriteLine("Timestamp: {0}", record.TimeStamp); Console.WriteLine("Severity: {0}", record.Severity.Description); Console.WriteLine("Sensor Type: {0}", record.SensorType.Description); Console.WriteLine("Sensor Number: {0}", record.SensorNumber); Console.WriteLine("Entity: {0}", record.Entity); Console.WriteLine("Entity Instance: {0}", record.EntityInstance); Console.WriteLine("Message: {0}", record.Message); Console.WriteLine("Event Type: {0}", record.EventType.Description); Console.WriteLine("Event Source: {0}", record.EventSource); Console.WriteLine("Device Address: {0}", record.DeviceAddress); Console.WriteLine("------------------------------------------------------------"); } } } }