import xmltodict
import Evtx.Evtx as evtx
def parse_evtx_file(evtx_path, exe_name, current_time):
logger.info(f"Parsing EVTX file: {evtx_path}")
crash_log = []
time_ago = current_time - timedelta(seconds=50000)
# 检查文件路径是否有效
if not evtx_path.exists():
logger.error(f"EVTX file does not exist: {evtx_path}")
return crash_log
try:
with evtx.Evtx(evtx_path) as log:
records = list(log.records())
logger.info(f"Found {len(records)} records in EVTX file")
for record in records:
record_xml = record.xml()
try:
record_dict = xmltodict.parse(record_xml)
except Exception as e:
logger.error(f"Error parsing record: {e}")
print(f"Error parsing record: {e}")
continue
syst
windows 使用python获取应用crash日志读取Application.evtx文件
于 2024-06-25 16:04:37 首次发布