Estoy usando Zabbix para analizar los registros de eventos de Windows. Aquí hay un ejemplo:
4624 An account was successfully logged on. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: SERVER$ Account Domain: COMPANY Logon ID: 0x3E7 Logon Information: Logon Type: 7 Restricted Admin Mode: - Virtual Account: No Elevated Token: No New Logon: Security ID: COMPANY\Susan Account Name: SUSAN Account Domain: COMPANY Logon ID: 0x3ED0915C Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {7bac704d-8521-0b5e-4548-5c61a3614dc0Y aquí está el javascript que estoy usando para extraer los datos que quiero:
var lines = value.split("\n"); var accountName = ""; var loginType = ""; var sourceIp = ""; lines.forEach(function(line) { if (line.trim().substring(0, 11) === "Logon Type:") { loginType = line.substring(12).trim(); } if (line.trim().substring(0, 13) === "Account Name:") { accountName = line.substring(14).trim(); } if (line.trim().substring(0, 23) === "Source Network Address:") { sourceIp = line.substring(24).trim(); } }); return loginType + " " + accountName + " " + sourceIp;Cuando esto se ejecuta contra los datos de registro, captará la primera aparición de Nombre de cuenta. Lo necesito para agarrar el segundo ya que es donde está el nombre del usuario.
¿Cómo puedo modificar lo que estoy haciendo para tomar este segundo en lugar del primero?
Gracias.
Si solo necesita resolver ese problema específico, simplemente haga un seguimiento de si ya encontró un nombre de cuenta y omita el primero:
var lines = value.split("\n"); var accountName = ""; var loginType = ""; var sourceIp = ""; // store the count of how many you have found while iterating let accountsFound = 0; lines.forEach(function(line) { if (line.trim().substring(0, 11) === "Logon Type:") { loginType = line.substring(12).trim(); } if (line.trim().substring(0, 13) === "Account Name:") { if (accountsFound === 1) { accountName = line.substring(14).trim(); } // keep track of how many you have found so far accountsFound++; } if (line.trim().substring(0, 23) === "Source Network Address:") { sourceIp = line.substring(24).trim(); } }); return loginType + " " + accountName + " " + sourceIp;Sin embargo, un mejor enfoque sería evitar subcadenas y simplemente dividir las cadenas en la clave y el valor una vez, como se muestra aquí:
const content = `4624 An account was successfully logged on. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: SERVER$ Account Domain: COMPANY Logon ID: 0x3E7 Logon Information: Logon Type: 7 Restricted Admin Mode: - Virtual Account: No Elevated Token: No New Logon: Security ID: COMPANY\Susan Account Name: SUSAN Account Domain: COMPANY Logon ID: 0x3ED0915C Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {7bac704d-8521-0b5e-4548-5c61a3614dc0`; function getDetails(value) { var lines = value.split("\n"); var accountName = "- not found -"; var loginType = "- not found -"; var sourceIp = "- not found -"; // store the count of how many you have found while iterating let accountsFound = 0; lines.forEach(function(line) { // just split each line on the : and trim each part to avoid all the substrings let key, value; [key, value] = line.trim().split(':'); if (key !== undefined) { key = key.trim(); } if (value !== undefined) { value = value.trim(); } // console.log(key, value); if (key === "Logon Type") { loginType = value; } if (key === "Account Name") { if (accountsFound === 1) { accountName = value; } // keep track of how many you have found so far accountsFound++; } if (key === "Source Network Address") { sourceIp = value; } }); return loginType + " " + accountName + " " + sourceIp; } console.log(getDetails(content));