Notepad ++と正規表現を使用して、WindowsのイベントからすべてのXMLを削除しようとしています。
私の正規表現は次のとおりです。
Event Xml:(.|\n)+?Event>\n
Windowsイベントの例は次のとおりです。
Log Name: System
Source: Service Control Manager
Date: 2016/04/29 11:54:00
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.Microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2016-04-29T10:54:00.113587400Z" />
<EventRecordID>299771</EventRecordID>
<Correlation />
<Execution ProcessID="696" ThreadID="3904" />
<Channel>System</Channel>
<Computer>hostname.domainname</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Adobe Flash Player Update Service</Data>
<Data Name="param2">stopped</Data>
<Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0031000000</Binary>
</EventData>
</Event>
Log Name: System
Source: Service Control Manager
Date: 2016/04/29 11:54:00
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.Microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2016-04-29T10:54:00.113587400Z" />
<EventRecordID>299770</EventRecordID>
<Correlation />
<Execution ProcessID="696" ThreadID="3904" />
<Channel>System</Channel>
<Computer>hostname.domainname</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Adobe Flash Player Update Service</Data>
<Data Name="param2">running</Data>
<Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0034000000</Binary>
</EventData>
</Event>
前述の正規表現は http://www.regexpal.com/ で機能します:
メニュー「検索」>「置換」(または Ctrl + H)
「検索対象」をEvent Xml:(.*?)Event>
に設定します
「置換」を空の文字列に設定します
「正規表現」を有効にする
「.matchesnewline」を有効にする
「すべて置換」をクリックします
Before:
Log Name: System
Source: Service Control Manager
Date: 2016/04/29 11:54:00
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.Microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2016-04-29T10:54:00.113587400Z" />
<EventRecordID>299771</EventRecordID>
<Correlation />
<Execution ProcessID="696" ThreadID="3904" />
<Channel>System</Channel>
<Computer>hostname.domainname</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Adobe Flash Player Update Service</Data>
<Data Name="param2">stopped</Data>
<Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0031000000</Binary>
</EventData>
</Event>
Log Name: System
Source: Service Control Manager
Date: 2016/04/29 11:54:00
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.Microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2016-04-29T10:54:00.113587400Z" />
<EventRecordID>299770</EventRecordID>
<Correlation />
<Execution ProcessID="696" ThreadID="3904" />
<Channel>System</Channel>
<Computer>hostname.domainname</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Adobe Flash Player Update Service</Data>
<Data Name="param2">running</Data>
<Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0034000000</Binary>
</EventData>
</Event>
後:
Log Name: System
Source: Service Control Manager
Date: 2016/04/29 11:54:00
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the stopped state.
Log Name: System
Source: Service Control Manager
Date: 2016/04/29 11:54:00
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: hostname.domainname
Description:
The Adobe Flash Player Update Service service entered the running state.
Notepad ++の「.matchesnew line」オプションをチェックする必要があります。そうしないと、正規表現は1行ずつのみ考慮されます。