I am using Zabbix to parse Windows event logs. Here is an example:
4624
An account was successfully logged on.
Subject:
Security ID: NT AUTHORITY\SYSTEM
Account Name: SERVER$
Account Domain: COMPANY
Logon ID: 0x3E7
Logon Information:
Logon Type: 7
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: No
New Logon:
Security ID: COMPANY\Susan
Account Name: SUSAN
Account Domain: COMPANY
Logon ID: 0x3ED0915C
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {7bac704d-8521-0b5e-4548-5c61a3614dc0
And here is the javascript I am using to pull the data I want:
var lines = value.split("\n");
var accountName = "";
var loginType = "";
var sourceIp = "";
lines.forEach(function(line) {
if (line.trim().substring(0, 11) === "Logon Type:") {
loginType = line.substring(12).trim();
}
if (line.trim().substring(0, 13) === "Account Name:") {
accountName = line.substring(14).trim();
}
if (line.trim().substring(0, 23) === "Source Network Address:") {
sourceIp = line.substring(24).trim();
}
});
return loginType + " " + accountName + " " + sourceIp;
When this is ran against the log data, it will grab the first occurrence of Account Name. I need it to grab the second one as that is where the user's name is.
How can I modify what I am doing to grab this second one rather than the first one?
Thank you.
If you only need to solve that specific problem, just track whether you have already found an Account Name and skip the first one:
var lines = value.split("\n");
var accountName = "";
var loginType = "";
var sourceIp = "";
// store the count of how many you have found while iterating
let accountsFound = 0;
lines.forEach(function(line) {
if (line.trim().substring(0, 11) === "Logon Type:") {
loginType = line.substring(12).trim();
}
if (line.trim().substring(0, 13) === "Account Name:") {
if (accountsFound === 1) {
accountName = line.substring(14).trim();
}
// keep track of how many you have found so far
accountsFound++;
}
if (line.trim().substring(0, 23) === "Source Network Address:") {
sourceIp = line.substring(24).trim();
}
});
return loginType + " " + accountName + " " + sourceIp;
A better approach though would be to avoid substringing things and just split the strings into the key and value once as shown here:
const content = `4624
An account was successfully logged on.
Subject:
Security ID: NT AUTHORITY\SYSTEM
Account Name: SERVER$
Account Domain: COMPANY
Logon ID: 0x3E7
Logon Information:
Logon Type: 7
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: No
New Logon:
Security ID: COMPANY\Susan
Account Name: SUSAN
Account Domain: COMPANY
Logon ID: 0x3ED0915C
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {7bac704d-8521-0b5e-4548-5c61a3614dc0`;
function getDetails(value) {
var lines = value.split("\n");
var accountName = "- not found -";
var loginType = "- not found -";
var sourceIp = "- not found -";
// store the count of how many you have found while iterating
let accountsFound = 0;
lines.forEach(function(line) {
// just split each line on the : and trim each part to avoid all the substrings
let key, value;
[key, value] = line.trim().split(':');
if (key !== undefined) {
key = key.trim();
}
if (value !== undefined) {
value = value.trim();
}
// console.log(key, value);
if (key === "Logon Type") {
loginType = value;
}
if (key === "Account Name") {
if (accountsFound === 1) {
accountName = value;
}
// keep track of how many you have found so far
accountsFound++;
}
if (key === "Source Network Address") {
sourceIp = value;
}
});
return loginType + " " + accountName + " " + sourceIp;
}
console.log(getDetails(content));