AD get records of security log..

Question

Hello everyone:)
i must get some records (by event id, time, etc..) of security log.
adler_steven answer me for previous my post(http://forum.java.sun.com/thread.jspa?threadID=5292943&messageID=10238354#10238354)
he sad look at http://forum.java.sun.com/thread.jspa?threadID=5116320&tstart=15
I must use WMI HTTP Mapper and some WBEM library...
Ok, i install and configure WMI HTTP Mapper and use next source for try get :) security log, by this dont work...
connect success, but retrieving information failed
adler_steven :) help me :)
*EXHIBIT A - Sun Industry Standards Source License
*"The contents of this file are subject to the Sun Industry
*Standards Source License Version 1.2 (the "License");
*You may not use this file except in compliance with the
*License. You may obtain a copy of the
*License at http://wbemservices.sourceforge.net/license.html
*Software distributed under the License is distributed on
*an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, either
*express or implied. See the License for the specific
*language governing rights and limitations under the License.
*The Original Code is WBEM Services.
*The Initial Developer of the Original Code is:
*Sun Microsystems, Inc.
*Portions created by: Sun Microsystems, Inc.
*are Copyright � 2001 Sun Microsystems, Inc.
*All Rights Reserved.
*Contributor(s): _______________________________________
import java.io.IOException;
import java.util.Enumeration;
import javax.wbem.cim.*;
import javax.wbem.client.*;
import javax.wbem.client.UserPrincipal;
import javax.wbem.client.PasswordCredential;
* This class will perform an CIMClient.execQuery using a WQL query string that
* is passed on the command line.  If a query isn't passed on the command line,
* the user will be prompted for the query
public class TestQuery {
    public TestQuery(String args[]) {
        String serverName = "win2003";
        String user = "administrator";
        String pass = "welcome1";
        CIMClient cimClient = null;
        CIMObjectPath cimPath = null;
        String wbemNameSpace = "root/CIMV2";
        int wbemPortNumber = 5988;
        String wbemProtocol = CIMClient.CIM_XML;
        try {
                System.out.println("connecting..\n");
                String hostURL = "http://" + serverName + ":" + wbemPortNumber;
                CIMNameSpace cimNameSpace = new CIMNameSpace(hostURL,wbemNameSpace);
                UserPrincipal userName = new UserPrincipal(user);
                PasswordCredential userPass = new PasswordCredential(pass);
                cimClient = new CIMClient(cimNameSpace,userName,userPass,wbemProtocol);
        catch (CIMException e) {
                System.err.println("Failed to access CIMOM: " + e);
        try {
                System.out.println("get win32_ntlogevent");
                cimPath = new CIMObjectPath("Win32_NTLogEvent");
                System.out.println("cimPath");
                Enumeration e = cimClient.enumerateInstances(cimPath); // this line hang
                System.out.println("Enumeration");
                if (e.hasMoreElements()) {
                        CIMInstance ci = (CIMInstance)e.nextElement();
                        // i think, there must be properties of Win32_NTLogEvent Class, such as message, eventid, eventcode...
                        CIMProperty cp = ci.getProperty("Message");
                        System.out.println("   Message: " + cp.getValue());
                System.out.println("stop get win32..");
                cimClient.close();
        catch (NullPointerException e) {
                System.err.println("Null Pointer Exception: " + e);
        catch (CIMException e) {
                System.err.println("Failed to enumerate WBEM Info: " + e);
    public static void main(String args[]) {
     new TestQuery(args);
{code}
Edited by: Jeqpbl4 on Jun 9, 2008 4:24 AM                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

Answer 1

I figure I've abused enough people today on the forum, that it's time to redeem myself.
Firstly, as I've always admitted, I'm not a Java developer, so there may be better ways of doing this. Secondly, I'm not an expert on WBEM/WMI, so I'm not sure of the different classes, methods or properties that WBEM exposes. I think I recommended some references in the links mentioned in this post, so if you want to dig deeper, go read those.
This is just a quick and dirty WBEM query that retrieves the security events. One thing I discovered is that if you have lots of events, you'll get a heap overflow exception. I guess there may be a way to retrieve pages of results, otherwise use a more refined query to return a smaller number of records.
* WBEMQueryLog, retrieve the entries from the security log from a server
* demonstrating the use of a WBEM Query
import java.io.*;
import java.util.*;
import javax.wbem.cim.*;
import javax.wbem.client.CIMClient;
import javax.wbem.client.UserPrincipal;
import javax.wbem.client.PasswordCredential;
public class wbemquerylog {
    public static void main(String args[]) throws CIMException {
     CIMClient cc = null;
     CIMObjectPath cop = null;
     CIMInstance ci = null;
     String hostname = "myServer";
     String nameSpace = "root/CIMV2";
     int portNumber = 5988;
     String hostURL = "http://" + hostname + ":" + portNumber;
     String protocol = CIMClient.CIM_XML;
     try {
         CIMNameSpace cns = new CIMNameSpace(hostURL,nameSpace);
         UserPrincipal username = new UserPrincipal("myServer/Administrator");
         PasswordCredential password = new PasswordCredential("XXXXXX");
         cc = new CIMClient(cns,username,password,protocol);
     catch (CIMException e) {
          System.err.println("Failed to access CIMOM: " + e);
          System.exit(1);
     cop = new CIMObjectPath();
     //lets try to get the Security Log entries, using a query
     try {
          cop = new CIMObjectPath();//"Win32_NTLogEvent");
          String query = "Select * from Win32_NTLogEvent where Logfile='Security'";
          Enumeration e = cc.execQuery(cop,query,CIMClient.WQL);
          for (int i = 1;e.hasMoreElements();i++) {
               System.out.println("Event: " + i);
               System.out.println(e.nextElement());
     catch (CIMException e) {
          System.err.println("Failed to query security log: " + e);
          System.exit(1);
     System.exit(0);
}If you want to retrieve specific Security Log Events, you could construct a more complex query, such as below, which will find Account Logon Failures
String query = "Select * from Win32_NTLogEvent where Logfile='Security' And EventCode = '681'";You could also use an enumeration as you have done, the only thing I haven't bothered to work out is how to enumerate the Security log itself, rather than every event in all the logs. I guess it's just a matter of working out what the CIM Path is, if it as at all possible.
* WBEMEnumLog, enumerate the NTEventLogs from a server
* Should find out the full CIM Path for the security logs
import java.io.*;
import java.util.*;
import javax.wbem.cim.*;
import javax.wbem.client.CIMClient;
import javax.wbem.client.UserPrincipal;
import javax.wbem.client.PasswordCredential;
public class wbemenumlog {
    public static void main(String args[]) throws CIMException {
     CIMClient cc = null;
     CIMObjectPath cop = null;
     CIMInstance ci = null;
     String hostname = "myServer";
     String nameSpace = "root/CIMV2";
     int portNumber = 5988;
     String hostURL = "http://" + hostname + ":" + portNumber;
     String protocol = CIMClient.CIM_XML;
     try {
         CIMNameSpace cns = new CIMNameSpace(hostURL,nameSpace);
         UserPrincipal username = new UserPrincipal("myServer/Administrator");
         PasswordCredential password = new PasswordCredential("XXXXXX");
         cc = new CIMClient(cns,username,password,protocol);
     catch (CIMException e) {
          System.err.println("Failed to access CIMOM: " + e);
          System.exit(1);
     cop = new CIMObjectPath();
     try {
          Enumeration en = cc.enumNameSpace(cop,true);
          if (en != null) {
               while (en.hasMoreElements()) {
                    CIMObjectPath obj = (CIMObjectPath)(en.nextElement());
                    System.out.println("Namespace: " + obj.toString());
     catch (CIMException e) {
          System.err.println("Failed to enumerate namespace: " + e);
          System.exit(1);
     //lets try to get the event logs
     try {
          cop = new CIMObjectPath("Win32_NTLogEvent");
          System.out.println("Host: " + cop.getHost());
          System.out.println("Object Name: " + cop.getObjectName());
          String attrs[] = {"Logfile","Sourcename","EventIdentifier","EventType","TimeGenerated","Type","CategoryString","User"};
          Enumeration e = cc.enumerateInstances(cop,false,false,false,false,attrs);
          for (int i = 1;e.hasMoreElements();i++) {
               System.out.println("Disk: " + i);
               System.out.println(e.nextElement());
     catch (CIMException e) {
          System.err.println("Failed to enumerate Event Log: " + e);
          System.exit(1);
     System.exit(0);
}Good luck....