Search code examples
c#xmlxmlreader

C# get XML Child node Values with XMLReader Class f

I have a problem.

I'm trying to read a huge XML File with Xmlreader Class. The Normal Reading and printing (Console) work fine.

But now I'm trying to filter for a specified child node and that doesn't work.

For Example:

This is my XML File

`<?xml version="1.0" encoding="UTF-8"?>
<Event>
   <System>
      <Provider Name="NetApp-Security-Auditing" Guid="{3CB2A168-FE19-4A4E-BDAD-DCF422F13473}" />
      <EventID>4660</EventID>
      <EventName>Delete Object Attempt</EventName>
      <Version>101.3</Version>
      <Source>CIFS</Source>
      <Level>0</Level>
      <Opcode>0</Opcode>
      <Keywords>0x8020000000000000</Keywords>
      <Result>Audit Success</Result>
      <TimeCreated SystemTime="2018-04-27T08:54:59.739617000Z" />
      <Correlation />
      <Channel>Security</Channel>
      <Computer>ta-cluster01/svm_ta_cifs</Computer>
      <ComputerUUID>7ec98fb6-de63-11e4-ba38-00a09864e708/0bbaf036-10e8-11e5-83fa-00a09864e708</ComputerUUID>
      <Security />
   </System>
   <EventData>
      <Data Name="SubjectIP" IPVersion="4">172.16.6.162</Data>
      <Data Name="SubjectUnix" Uid="65534" Gid="65534" Local="false" />
      <Data Name="SubjectUserSid">S-1-5-21-4259334589-2141180538-67931973-13448</Data>
      <Data Name="SubjectUserIsLocal">false</Data>
      <Data Name="SubjectDomainName">TDLZ2</Data>
      <Data Name="SubjectUserName">hegelbachpatrik</Data>
      <Data Name="ObjectServer">Security</Data>
      <Data Name="ObjectType">File</Data>
      <Data Name="HandleID">00000000000420;00;00011f73;13890cc2</Data>
      <Data Name="ObjectName">(gruppe05_homes);/test/testuser/Vorlagen/LiveContent/16/Managed/Document Themes/1031/TM02836342[[fn=Ion]].thmx</Data>
      <Data Name="InformationSet">Delete on last close;</Data>
   </EventData>
</Event>`

Now I want to check if the name of the child node InformationSet contains the value "Delete on last close". If this is True, it should print me the whole EventData node

Below you'll see my C# code which I've tried to print the child nodes "Data" But it doesn't work, can anybody help me?

 var reader = XmlReader.Create(@"\\testserver\Example.xml");
        var test = reader.ReadToDescendant("EventData");
        while (reader.Read()&& reader.Name == "Data")
        {
           Console.WriteLine(reader.Value);           




        }

The right file look like this

@jdweng

I'm sorry, I should say that clearly. The XML File look like this.

<Events xmlns="http://www.netapp.com/schemas/ONTAP/2007/AuditLog">
<Event><System><Provider Name="NetApp-Security-Auditing" Guid="{3CB2A168-FE19-4A4E-BDAD-DCF422F13473}"/><EventID>4656</EventID><EventName>Open Object</EventName><Version>101.3</Version><Source>CIFS</Source><Level>0</Level><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><Result>Audit Success</Result><TimeCreated SystemTime="2018-05-04T11:13:55.231818000Z"/><Correlation/><Channel>Security</Channel><Computer>ta/svm_ta_cifs</Computer><ComputerUUID>7ec98fb6-de63-11e4-ba38-00a09864e708/0bbaf036-10e8-11e5-83fa-00a09864e708</ComputerUUID><Security/></System><EventData><Data Name="SubjectIP" IPVersion="4">172.16.6.71</Data><Data Name="SubjectUnix" Uid="65534" Gid="65534" Local="false"></Data><Data Name="SubjectUserSid">S-1-5-21-4259334589-2141180538-67931973-2742</Data><Data Name="SubjectUserIsLocal">false</Data><Data Name="SubjectDomainName">test</Data><Data Name="SubjectUserName">test</Data><Data Name="ObjectServer">Security</Data><Data Name="ObjectType">File</Data><Data Name="HandleID">00000000000420;00;00015148;21fdd9f2</Data><Data Name="ObjectName">(gruppe05_homes);/tal/test/Scripte indiv/ISAGReports_RichTextWerbemitteilungen.txt</Data><Data Name="AccessList">%%4423 %%1537 </Data><Data Name="AccessMask">1080</Data><Data Name="DesiredAccess">Read Attributes; Delete; </Data><Data Name="Attributes">Open a non-directory; </Data></EventData></Event>
<Event><System><Provider Name="NetApp-Security-Auditing" Guid="{3CB2A168-FE19-4A4E-BDAD-DCF422F13473}"/><EventID>4660</EventID><EventName>Delete Object Attempt</EventName><Version>101.3</Version><Source>CIFS</Source><Level>0</Level><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><Result>Audit Success</Result><TimeCreated SystemTime="2018-05-04T11:13:55.238819000Z"/><Correlation/><Channel>Security</Channel><Computer>ta/svm_ta_cifs</Computer><ComputerUUID>7ec98fb6-de63-11e4-ba38-00a09864e708/0bbaf036-10e8-11e5-83fa-00a09864e708</ComputerUUID><Security/></System><EventData><Data Name="SubjectIP" IPVersion="4">172.16.6.71</Data><Data Name="SubjectUnix" Uid="65534" Gid="65534" Local="false"></Data><Data Name="SubjectUserSid">S-1-5-21-4259334589-2141180538-67931973-2742</Data><Data Name="SubjectUserIsLocal">false</Data><Data Name="SubjectDomainName">test</Data><Data Name="SubjectUserName">test</Data><Data Name="ObjectServer">Security</Data><Data Name="ObjectType">File</Data><Data Name="HandleID">00000000000420;00;00015148;21fdd9f2</Data><Data Name="ObjectName">(gruppe05_homes);/tal/test/ISAGReports_RichTextWerbemitteilungen.txt</Data><Data Name="InformationSet">Delete on last close; </Data></EventData></Event>
</Events>
Solution

  • Try following :

        using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Text;
    using System.Xml;
    using System.Xml.Linq;

    namespace ConsoleApplication1
    {
        class Program
        {
            const string FILENAME = @"c:\temp\test.xml";
            static void Main(string[] args)
            {
                var reader = XmlReader.Create(FILENAME);
                reader.MoveToContent();
                string ns = reader.NamespaceURI;
                //if this doesn't work hard code ns
                // string ns = "http://www.netapp.com/schemas/ONTAP/2007/AuditLog";

                while (!reader.EOF)
                {
                    if (reader.Name != "EventData")
                    {
                        reader.ReadToFollowing("EventData",ns);
                    }
                    if (!reader.EOF)
                    {
                        XElement eventData = (XElement)XElement.ReadFrom(reader);
                        foreach (XElement data in eventData.Elements("Data"))
                        {
                            Console.WriteLine("{0} : {1}", (string)data.Attribute("Name"), (string)data);
                        }
                    }
                }
                Console.ReadLine();

            }
        }
    }