如何获取EventLog将用户名记录到Window Event Log中? [英] How to get EventLog to record user name into Window Event Log?

问题描述

我正在写 Windows事件日志使用C#.我可以设置mmc.exe计算机管理"工具中可见的每个字段，但用户"字段除外.

I'm writing to the windows event log using C#. I can set every field visible in the mmc.exe "Computer Management" tool, except for the User field.

客户端应用程序是ASP.NET，并使用表单身份验证.

The client application is ASP.NET and uses forms authentication.

public static void WriteOnce()
{
    EventLog log = new EventLog("MyApp");
    if (!EventLog.SourceExists("MySource"))
    {
        EventSourceCreationData data = new EventSourceCreationData("MySource", "MyApp");
        EventLog.CreateEventSource(data);
    }
    log.Source = "MySource";
    log.WriteEntry("Hello World", EventLogEntryType.Information,123,456,new byte[]{1,2,3});
}

更新:我在ASP.NET中进行了检查，即使设置了identityimpersonation = true&身份验证= Windows，仍然没有用户.

UPDATE: I checked, in ASP.NET even if set identity impersonation=true & authentication=windows and still no user.

我还在控制台应用程序中检查了没有用户.

I also checked, in a console app, no user.

推荐答案

尽管似乎没有完全托管的方法，但我找到了一个博客文章来说明如何做到这一点.要捕获用户ID，您必须使用pinvoke/本机方法调用.

I found a blog entry that explains how to do it, although there doesn't seem to be a completely managed way to do it. To capture the user Id, you have to use pinvoke/native method calls.

http://www.infosysblogs.com/microsoft/2007/09 /logging_events_with_user_detai_1.html

对于上述情况，它将用户登录为ASPNET或NETWORK SERVICES，或者将用户登录为控制台应用程序. api调用本身采用指向SID的指针参数.我没有尝试过欺骗的可能性.

For the above, it logs the user as ASPNET or NETWORK SERVICES, or the logged in user for console apps. The api call itself takes a pointer parameter to a SID. I didn't try to see if spoofing was possible.

JPucket可能是正确的，在系统事件日志中获取表单身份验证用户ID的唯一方法是通过消息字段.

JPucket may be right, that the only way to get the ID of a forms authenticated user in the System Event Log is via the message field.

这篇关于如何获取EventLog将用户名记录到Window Event Log中?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！