读取远程服务器事件日志以获取AD用户登录和注销事件并将其保存到SQL

Question

Does anyone know how to get the user logon and log-off event logs from a SERVER 2012 Active directory into SQL server using C#? I would preferably run the service from a remote computer.

Your assistance is appreciated!

Answer 1

Take a look at LogParser its a Microsoft command line tool for querying things like event logs and IIS log files. I have seen it used to filter event logs (but not the security logs). From memory the syntax is pretty fussy. You can shell out a call to log parser form C#, output to a text file, then read the file and import to SQL Server.

eg

LogParser.EXE -i:EVT "SELECT TimeGenerated,EventTypeName FROM System WHERE TimeGenerated > '2014-03-25 00:00:00' " > C:\\TodaysEvents.csv

I think you can access remote servers too using FROM \\\\RemoteServer\\System

Edit: I just checked: There is an option to query Active Directory in log parser. Use the -i:ADS option