GetEventCommand.cs

// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.

using System;
using System.Collections;
using System.Collections.Generic;
using System.Collections.ObjectModel;
using System.Collections.Specialized;
using System.Diagnostics.CodeAnalysis;
using System.Diagnostics.Eventing.Reader;
using System.Globalization;
using System.Management.Automation;
using System.Net;
using System.Resources;
using System.Security.Principal;
using System.Text;
using System.Xml;

[assembly: CLSCompliant(false)]

namespace Microsoft.PowerShell.Commands
{
    /// <summary>
    /// Class that implements the Get-WinEvent cmdlet.
    /// </summary>
    [OutputType(typeof(EventRecord), ParameterSetName = new string[] { "GetLogSet", "GetProviderSet", "FileSet", "HashQuerySet", "XmlQuerySet" })]
    [OutputType(typeof(ProviderMetadata), ParameterSetName = new string[] { "ListProviderSet" })]
    [OutputType(typeof(EventLogConfiguration), ParameterSetName = new string[] { "ListLogSet" })]
    [Cmdlet(VerbsCommon.Get, "WinEvent", DefaultParameterSetName = "GetLogSet", HelpUri = "https://go.microsoft.com/fwlink/?LinkID=2096581")]
    public sealed class GetWinEventCommand : PSCmdlet
    {
        /// <summary>
        /// ListLog parameter.
        /// </summary>
        [Parameter(
                Position = 0,
                Mandatory = true,
                ParameterSetName = "ListLogSet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "ListLogParamHelp")]
        [AllowEmptyCollection]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays",
                            Scope = "member",
                            Target = "Microsoft.PowerShell.Commands.GetEvent.ListLog",
                            Justification = "A string[] is required here because that is the type Powershell supports")]
        public string[] ListLog { get; set; } = { "*" };

        /// <summary>
        /// GetLog parameter.
        /// </summary>
        [Parameter(
                Position = 0,
                ParameterSetName = "GetLogSet",
                ValueFromPipeline = true,
                ValueFromPipelineByPropertyName = true,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "GetLogParamHelp")]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays",
                            Scope = "member",
                            Target = "Microsoft.PowerShell.Commands.GetEvent.LogName",
                            Justification = "A string[] is required here because that is the type Powershell supports")]
        public string[] LogName { get; set; } = { "*" };

        /// <summary>
        /// ListProvider parameter.
        /// </summary>
        [Parameter(
                Position = 0,
                Mandatory = true,
                ParameterSetName = "ListProviderSet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "ListProviderParamHelp")]
        [AllowEmptyCollection]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays",
                            Scope = "member",
                            Target = "Microsoft.PowerShell.Commands.GetEvent.ListProvider",
                            Justification = "A string[] is required here because that is the type Powershell supports")]
        public string[] ListProvider { get; set; } = { "*" };

        /// <summary>
        /// ProviderName parameter.
        /// </summary>
        [Parameter(
                Position = 0,
                Mandatory = true,
                ParameterSetName = "GetProviderSet",
                ValueFromPipelineByPropertyName = true,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "GetProviderParamHelp")]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays",
                            Scope = "member",
                            Target = "Microsoft.PowerShell.Commands.GetEvent.ProviderName",
                            Justification = "A string[] is required here because that is the type Powershell supports")]
        public string[] ProviderName { get; set; }

        /// <summary>
        /// Path parameter.
        /// </summary>
        [Parameter(
                Position = 0,
                Mandatory = true,
                ParameterSetName = "FileSet",
                ValueFromPipelineByPropertyName = true,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "PathParamHelp")]
        [Alias("PSPath")]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays",
                            Scope = "member",
                            Target = "Microsoft.PowerShell.Commands.GetEvent.Path",
                            Justification = "A string[] is required here because that is the type Powershell supports")]
        public string[] Path { get; set; }

        /// <summary>
        /// MaxEvents parameter.
        /// </summary>
        [Parameter(
                ParameterSetName = "FileSet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "MaxEventsParamHelp")]
        [Parameter(
                ParameterSetName = "GetProviderSet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "MaxEventsParamHelp")]
        [Parameter(
                ParameterSetName = "GetLogSet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "MaxEventsParamHelp")]
        [Parameter(
                ParameterSetName = "HashQuerySet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "MaxEventsParamHelp")]
        [Parameter(
                ParameterSetName = "XmlQuerySet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "MaxEventsParamHelp")]
        [ValidateRange((long)1, long.MaxValue)]
        public long MaxEvents { get; set; } = -1;

        /// <summary>
        /// ComputerName parameter.
        /// </summary>
        [Parameter(
                ParameterSetName = "ListProviderSet",
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "ComputerNameParamHelp")]
        [Parameter(
                ParameterSetName = "GetProviderSet",
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "ComputerNameParamHelp")]
        [Parameter(
                ParameterSetName = "ListLogSet",
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "ComputerNameParamHelp")]
        [Parameter(
                ParameterSetName = "GetLogSet",
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "ComputerNameParamHelp")]
        [Parameter(
                ParameterSetName = "HashQuerySet",
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "ComputerNameParamHelp")]
        [Parameter(
                ParameterSetName = "XmlQuerySet",
                HelpMessageBaseName = "GetEventResources",
                HelpMessageResourceId = "ComputerNameParamHelp")]
        [ValidateNotNull]
        [Alias("Cn")]
        public string ComputerName { get; set; } = string.Empty;

        /// <summary>
        /// Credential parameter.
        /// </summary>
        [Parameter(ParameterSetName = "ListProviderSet")]
        [Parameter(ParameterSetName = "GetProviderSet")]
        [Parameter(ParameterSetName = "ListLogSet")]
        [Parameter(ParameterSetName = "GetLogSet")]
        [Parameter(ParameterSetName = "HashQuerySet")]
        [Parameter(ParameterSetName = "XmlQuerySet")]
        [Parameter(ParameterSetName = "FileSet")]
        [Credential]
        public PSCredential Credential { get; set; } = PSCredential.Empty;

        /// <summary>
        /// FilterXPath parameter.
        /// </summary>
        [Parameter(
                ParameterSetName = "FileSet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources")]
        [Parameter(
                ParameterSetName = "GetProviderSet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources")]
        [Parameter(
                ParameterSetName = "GetLogSet",
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                HelpMessageBaseName = "GetEventResources")]
        [ValidateNotNull]
        public string FilterXPath { get; set; } = "*";

        /// <summary>
        /// FilterXml parameter.
        /// </summary>
        [Parameter(
                Position = 0,
                Mandatory = true,
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                ParameterSetName = "XmlQuerySet",
                HelpMessageBaseName = "GetEventResources")]
        [SuppressMessage("Microsoft.Design", "CA1059:MembersShouldNotExposeCertainConcreteTypes",
                            Scope = "member",
                            Target = "Microsoft.PowerShell.Commands.GetEvent.FilterXml",
                            Justification = "An XmlDocument is required here because that is the type Powershell supports")]
        public XmlDocument FilterXml { get; set; }

        /// <summary>
        /// FilterHashtable parameter.
        /// </summary>
        [Parameter(
                Position = 0,
                Mandatory = true,
                ValueFromPipeline = false,
                ValueFromPipelineByPropertyName = false,
                ParameterSetName = "HashQuerySet",
                HelpMessageBaseName = "GetEventResources")]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays",
                            Scope = "member",
                            Target = "Microsoft.PowerShell.Commands.GetEvent.FilterHashtable",
                            Justification = "A string[] is required here because that is the type Powershell supports")]
        public Hashtable[] FilterHashtable { get; set; }

        /// <summary>
        /// Force switch.
        /// </summary>
        [Parameter(ParameterSetName = "ListLogSet")]
        [Parameter(ParameterSetName = "GetProviderSet")]
        [Parameter(ParameterSetName = "GetLogSet")]
        [Parameter(ParameterSetName = "HashQuerySet")]
        public SwitchParameter Force { get; set; }

        /// <summary>
        /// Oldest switch.
        /// </summary>
        [Parameter(ParameterSetName = "FileSet")]
        [Parameter(ParameterSetName = "GetProviderSet")]
        [Parameter(ParameterSetName = "GetLogSet")]
        [Parameter(ParameterSetName = "HashQuerySet")]
        [Parameter(ParameterSetName = "XmlQuerySet")]
        public SwitchParameter Oldest
        {
            get { return _oldest; }

            set { _oldest = value; }
        }

        private bool _oldest = false;

        //
        // Query builder constant strings
        //
        private const string queryListOpen = "<QueryList>";
        private const string queryListClose = "</QueryList>";
        private const string queryTemplate = "<Query Id=\"{0}\" Path=\"{1}\"><Select Path=\"{1}\">{2}</Select></Query>";
        private const string queryOpenerTemplate = "<Query Id=\"{0}\" Path=\"{1}\"><Select Path=\"{1}\">*";
        private const string queryCloser = "</Query>";
        private const string SelectCloser = "</Select>";
        private const string suppressOpener = "<Suppress>*";
        private const string suppressCloser = "</Suppress>";
        private const char propOpen = '[';
        private const char propClose = ']';
        private const string filePrefix = "file://";
        private const string NamedDataTemplate = "((EventData[Data[@Name='{0}']='{1}']) or (UserData/*/{0}='{1}'))";
        private const string DataTemplate = "(EventData/Data='{0}')";
        private const string SystemTimePeriodTemplate = "(System/TimeCreated[@SystemTime&gt;='{0}' and @SystemTime&lt;='{1}'])";
        private const string SystemTimeStartTemplate = "(System/TimeCreated[@SystemTime&gt;='{0}'])";
        private const string SystemTimeEndTemplate = "(System/TimeCreated[@SystemTime&lt;='{0}'])";
        private const string SystemLevelTemplate = "(System/Level=";
        private const string SystemEventIDTemplate = "(System/EventID=";
        private const string SystemSecurityTemplate = "(System/Security[@UserID='{0}'])";
        private const string SystemKeywordsTemplate = "System[band(Keywords,{0})]";

        //
        // Other private members and constants
        //
        private ResourceManager _resourceMgr = null;
        private readonly Dictionary<string, StringCollection> _providersByLogMap = new();

        private StringCollection _logNamesMatchingWildcard = null;
        private readonly StringCollection _resolvedPaths = new();

        private readonly List<string> _accumulatedLogNames = new();
        private readonly List<string> _accumulatedProviderNames = new();
        private readonly List<string> _accumulatedFileNames = new();

        private const uint MAX_EVENT_BATCH = 100;

        //
        // Hashtable query key names
        //
        private const string hashkey_logname_lc = "logname";
        private const string hashkey_providername_lc = "providername";
        private const string hashkey_path_lc = "path";
        private const string hashkey_keywords_lc = "keywords";
        private const string hashkey_id_lc = "id";
        private const string hashkey_level_lc = "level";
        private const string hashkey_starttime_lc = "starttime";
        private const string hashkey_endtime_lc = "endtime";
        private const string hashkey_userid_lc = "userid";
        private const string hashkey_data_lc = "data";
        private const string hashkey_supress_lc = "suppresshashfilter";

        /// <summary>
        /// BeginProcessing() is invoked once per pipeline: we will load System.Core.dll here.
        /// </summary>
        protected override void BeginProcessing()
        {
            _resourceMgr = Microsoft.PowerShell.Commands.Diagnostics.Common.CommonUtilities.GetResourceManager();
        }

        /// <summary>
        /// EndProcessing() is invoked once per pipeline.
        /// </summary>
        protected override void EndProcessing()
        {
            switch (ParameterSetName)
            {
                case "GetLogSet":
                    ProcessGetLog();
                    break;

                case "FileSet":
                    ProcessFile();
                    break;

                case "GetProviderSet":
                    ProcessGetProvider();
                    break;

                default:
                    break;
            }
        }

        /// <summary>
        /// ProcessRecord() override.
        /// This is the main entry point for the cmdlet.
        /// </summary>
        protected override void ProcessRecord()
        {
            switch (ParameterSetName)
            {
                case "ListLogSet":
                    ProcessListLog();
                    break;

                case "ListProviderSet":
                    ProcessListProvider();
                    break;

                case "GetLogSet":
                    AccumulatePipelineLogNames();
                    break;

                case "FileSet":
                    AccumulatePipelineFileNames();
                    break;

                case "HashQuerySet":
                    ProcessHashQuery();
                    break;

                case "GetProviderSet":
                    AccumulatePipelineProviderNames();
                    break;

                case "XmlQuerySet":
                    ProcessFilterXml();
                    break;

                default:
                    WriteDebug(string.Create(CultureInfo.InvariantCulture, $"Invalid parameter set name: {ParameterSetName}"));
                    break;
            }
        }

        //
        // AccumulatePipelineCounters() accumulates log names in the pipeline scenario:
        // we do not want to construct a query until all the log names are supplied.
        //
        private void AccumulatePipelineLogNames()
        {
            _accumulatedLogNames.AddRange(LogName);
        }

        //
        // AccumulatePipelineProviderNames() accumulates provider names in the pipeline scenario:
        // we do not want to construct a query until all the provider names are supplied.
        //
        private void AccumulatePipelineProviderNames()
        {
            _accumulatedProviderNames.AddRange(LogName);
        }

        //
        // AccumulatePipelineFileNames() accumulates log file paths in the pipeline scenario:
        // we do not want to construct a query until all the file names are supplied.
        //
        private void AccumulatePipelineFileNames()
        {
            _accumulatedFileNames.AddRange(LogName);
        }

        //
        // Process GetLog parameter set
        //
        private void ProcessGetLog()
        {
            using (EventLogSession eventLogSession = CreateSession())
            {
                FindLogNamesMatchingWildcards(eventLogSession, _accumulatedLogNames);
                if (_logNamesMatchingWildcard.Count == 0)
                {
                    return;
                }

                EventLogQuery logQuery;
                if (_logNamesMatchingWildcard.Count > 1)
                {
                    string query = BuildStructuredQuery(eventLogSession);
                    logQuery = new EventLogQuery(null, PathType.LogName, query);
                    logQuery.TolerateQueryErrors = true;
                }
                else
                {
                    logQuery = new EventLogQuery(_logNamesMatchingWildcard[0], PathType.LogName, FilterXPath);
                }

                logQuery.Session = eventLogSession;
                logQuery.ReverseDirection = !_oldest;

                ReadEvents(logQuery);
            }
        }

        //
        // Process GetProviderSet parameter set
        //
        private void ProcessGetProvider()
        {
            using (EventLogSession eventLogSession = CreateSession())
            {
                FindProvidersByLogForWildcardPatterns(eventLogSession, ProviderName);

                if (_providersByLogMap.Count == 0)
                {
                    //
                    // Just return: errors already written above for each unmatched provider name pattern.
                    //
                    return;
                }

                EventLogQuery logQuery = null;
                if (_providersByLogMap.Count > 1)
                {
                    string query = BuildStructuredQuery(eventLogSession);
                    logQuery = new EventLogQuery(null, PathType.LogName, query);
                    logQuery.TolerateQueryErrors = true;
                }
                else
                {
                    //
                    // There's only one key at this point, but we need an enumerator to get to it.
                    //
                    foreach (string log in _providersByLogMap.Keys)
                    {
                        logQuery = new EventLogQuery(log, PathType.LogName, AddProviderPredicatesToFilter(_providersByLogMap[log]));
                        WriteVerbose(string.Create(CultureInfo.InvariantCulture, $"Log {log} will be queried"));
                    }
                }

                logQuery.Session = eventLogSession;
                logQuery.ReverseDirection = !_oldest;

                ReadEvents(logQuery);
            }
        }

        //
        // Process ListLog parameter set
        //
        private void ProcessListLog()
        {
            using (EventLogSession eventLogSession = CreateSession())
            {
                foreach (string logPattern in ListLog)
                {
                    bool bMatchFound = false;
                    WildcardPattern wildLogPattern = new(logPattern, WildcardOptions.IgnoreCase);

                    foreach (string logName in eventLogSession.GetLogNames())
                    {
                        if (((!WildcardPattern.ContainsWildcardCharacters(logPattern))
                            && string.Equals(logPattern, logName, StringComparison.OrdinalIgnoreCase))
                            ||
                            (wildLogPattern.IsMatch(logName)))
                        {
                            try
                            {
                                EventLogConfiguration logObj = new(logName, eventLogSession);

                                //
                                // Skip direct channels matching the wildcard unless -Force is present.
                                //
                                if (!Force.IsPresent &&
                                    WildcardPattern.ContainsWildcardCharacters(logPattern) &&
                                        (logObj.LogType == EventLogType.Debug ||
                                        logObj.LogType == EventLogType.Analytical))
                                {
                                    continue;
                                }

                                EventLogInformation logInfoObj = eventLogSession.GetLogInformation(logName, PathType.LogName);

                                PSObject outputObj = new(logObj);

                                outputObj.Properties.Add(new PSNoteProperty("FileSize", logInfoObj.FileSize));
                                outputObj.Properties.Add(new PSNoteProperty("IsLogFull", logInfoObj.IsLogFull));
                                outputObj.Properties.Add(new PSNoteProperty("LastAccessTime", logInfoObj.LastAccessTime));
                                outputObj.Properties.Add(new PSNoteProperty("LastWriteTime", logInfoObj.LastWriteTime));
                                outputObj.Properties.Add(new PSNoteProperty("OldestRecordNumber", logInfoObj.OldestRecordNumber));
                                outputObj.Properties.Add(new PSNoteProperty("RecordCount", logInfoObj.RecordCount));

                                WriteObject(outputObj);
                                bMatchFound = true;
                            }
                            catch (Exception exc)
                            {
                                string msg = string.Format(CultureInfo.InvariantCulture,
                                                        _resourceMgr.GetString("LogInfoUnavailable"),
                                                        logName, exc.Message);
                                Exception outerExc = new(msg, exc);
                                WriteError(new ErrorRecord(outerExc, "LogInfoUnavailable", ErrorCategory.NotSpecified, null));
                                continue;
                            }
                        }
                    }

                    if (!bMatchFound)
                    {
                        string msg = _resourceMgr.GetString("NoMatchingLogsFound");
                        Exception exc = new(string.Format(CultureInfo.InvariantCulture, msg, ComputerName, logPattern));
                        WriteError(new ErrorRecord(exc, "NoMatchingLogsFound", ErrorCategory.ObjectNotFound, null));
                    }
                }
            }
        }

        //
        // Process ListProvider parameter set
        //
        private void ProcessListProvider()
        {
            using (EventLogSession eventLogSession = CreateSession())
            {
                foreach (string provPattern in ListProvider)
                {
                    bool bMatchFound = false;
                    WildcardPattern wildProvPattern = new(provPattern, WildcardOptions.IgnoreCase);

                    foreach (string provName in eventLogSession.GetProviderNames())
                    {
                        if (((!WildcardPattern.ContainsWildcardCharacters(provPattern))
                            && string.Equals(provPattern, provName, StringComparison.OrdinalIgnoreCase))
                            ||
                            (wildProvPattern.IsMatch(provName)))
                        {
                            try
                            {
                                ProviderMetadata provObj = new(provName, eventLogSession, CultureInfo.CurrentCulture);
                                WriteObject(provObj);
                                bMatchFound = true;
                            }
                            catch (System.Diagnostics.Eventing.Reader.EventLogException exc)
                            {
                                string msg = string.Format(CultureInfo.InvariantCulture,
                                                        _resourceMgr.GetString("ProviderMetadataUnavailable"),
                                                        provName, exc.Message);
                                Exception outerExc = new(msg, exc);
                                WriteError(new ErrorRecord(outerExc, "ProviderMetadataUnavailable", ErrorCategory.NotSpecified, null));
                                continue;
                            }
                        }
                    }

                    if (!bMatchFound)
                    {
                        string msg = string.Format(CultureInfo.InvariantCulture, _resourceMgr.GetString("NoMatchingProvidersFound"),
                                                ComputerName, provPattern);
                        Exception exc = new(msg);
                        WriteError(new ErrorRecord(exc, "NoMatchingProvidersFound", ErrorCategory.ObjectNotFound, null));
                    }
                }
            }
        }

        //
        // Process FilterXml parameter set
        //
        private void ProcessFilterXml()
        {
            using (EventLogSession eventLogSession = CreateSession())
            {
                if (!Oldest.IsPresent)
                {
                    //
                    // Do minimal parsing of xmlQuery to determine if any direct channels or ETL files are in it.
                    //
                    XmlElement root = FilterXml.DocumentElement;
                    XmlNodeList queryNodes = root.SelectNodes("//Query//Select");
                    foreach (XmlNode queryNode in queryNodes)
                    {
                        XmlAttributeCollection attribs = queryNode.Attributes;
                        foreach (XmlAttribute attrib in attribs)
                        {
                            if (attrib.Name.Equals("Path", StringComparison.OrdinalIgnoreCase))
                            {
                                string logName = attrib.Value;

                                if (logName.StartsWith(filePrefix, StringComparison.OrdinalIgnoreCase))
                                {
                                    TerminateForNonEvtxFileWithoutOldest(logName);
                                }

                                ValidateLogName(logName, eventLogSession);
                            }
                        }
                    }
                }

                EventLogQuery logQuery = new(null, PathType.LogName, FilterXml.InnerXml);
                logQuery.Session = eventLogSession;
                logQuery.ReverseDirection = !_oldest;

                ReadEvents(logQuery);
            }
        }

        //
        // Process FileSet parameter set
        //
        private void ProcessFile()
        {
            using (EventLogSession eventLogSession = CreateSession())
            {
                //
                // At this point, _path array contains paths that might have wildcards,
                // environment variables or PS drives. Let's resolve those.
                //
                for (int i = 0; i < Path.Length; i++)
                {
                    StringCollection resolvedPaths = ValidateAndResolveFilePath(Path[i]);
                    foreach (string resolvedPath in resolvedPaths)
                    {
                        _resolvedPaths.Add(resolvedPath);
                        WriteVerbose(string.Create(CultureInfo.InvariantCulture, $"Found file {resolvedPath}"));
                    }
                }

                EventLogQuery logQuery = null;
                if (_resolvedPaths.Count == 0)
                {
                    return;
                }
                else if (_resolvedPaths.Count > 1)
                {
                    string query = BuildStructuredQuery(eventLogSession);
                    logQuery = new EventLogQuery(null, PathType.FilePath, query);
                    logQuery.TolerateQueryErrors = true;
                }
                else
                {
                    logQuery = new EventLogQuery(_resolvedPaths[0], PathType.FilePath, FilterXPath);
                }

                logQuery.Session = eventLogSession;
                logQuery.ReverseDirection = !_oldest;

                ReadEvents(logQuery);
            }
        }

        //
        // Process HashQuerySet parameter set
        //
        private void ProcessHashQuery()
        {
            CheckHashTablesForNullValues();

            using (EventLogSession eventLogSession = CreateSession())
            {
                string query = BuildStructuredQuery(eventLogSession);
                if (query.Length == 0)
                {
                    return;
                }

                EventLogQuery logQuery = new(null, PathType.FilePath, query);
                logQuery.Session = eventLogSession;
                logQuery.TolerateQueryErrors = true;
                logQuery.ReverseDirection = !_oldest;

                ReadEvents(logQuery);
            }
        }

        //
        // CreateSession creates an EventLogSession connected to a target machine or localhost.
        // If _credential argument is PSCredential.Empty, the session will be created for the current context.
        //
        private EventLogSession CreateSession()
        {
            EventLogSession eventLogSession = null;

            if (ComputerName == string.Empty)
            {
                // Set _computerName to "localhost" for future error messages,
                // but do not use it for the connection to avoid RPC overhead.
                ComputerName = "localhost";

                if (Credential == PSCredential.Empty)
                {
                    return new EventLogSession();
                }
            }
            else if (Credential == PSCredential.Empty)
            {
                return new EventLogSession(ComputerName);
            }

            // If we are here, either both computer name and credential were passed initially,
            // or credential only - we will use it with "localhost"

            NetworkCredential netCred = (NetworkCredential)Credential;
            eventLogSession = new EventLogSession(ComputerName,
                                 netCred.Domain,
                                 netCred.UserName,
                                 Credential.Password,
                                 SessionAuthentication.Default
                                 );
            //
            // Force the destruction of cached password
            //
            netCred.Password = string.Empty;

            return eventLogSession;
        }

        //
        // ReadEvents helper.
        //
        private void ReadEvents(EventLogQuery logQuery)
        {
            using (EventLogReader readerObj = new(logQuery))
            {
                long numEvents = 0;
                EventRecord evtObj = null;

                while (true)
                {
                    try
                    {
                        evtObj = readerObj.ReadEvent();
                    }
                    catch (Exception exc)
                    {
                        WriteError(new ErrorRecord(exc, exc.Message, ErrorCategory.NotSpecified, null));
                        continue;
                    }

                    if (evtObj == null)
                    {
                        break;
                    }

                    if (MaxEvents != -1 && numEvents >= MaxEvents)
                    {
                        break;
                    }

                    PSObject outputObj = new(evtObj);

                    string evtMessage = _resourceMgr.GetString("NoEventMessage");
                    try
                    {
                        evtMessage = evtObj.FormatDescription();
                    }
                    catch (Exception exc)
                    {
                        WriteError(new ErrorRecord(exc, exc.Message, ErrorCategory.NotSpecified, null));
                    }

                    outputObj.Properties.Add(new PSNoteProperty("Message", evtMessage));

                    //
                    // Enumerate the object one level to get to event payload
                    //
                    WriteObject(outputObj, true);
                    numEvents++;
                }

                if (numEvents == 0)
                {
                    string msg = _resourceMgr.GetString("NoMatchingEventsFound");
                    Exception exc = new(msg);
                    WriteError(new ErrorRecord(exc, "NoMatchingEventsFound", ErrorCategory.ObjectNotFound, null));
                }
            }
        }

        //
        // BuildStructuredQuery() builds a structured query from cmdlet arguments.
        //
        private string BuildStructuredQuery(EventLogSession eventLogSession)
        {
            StringBuilder result = new();

            switch (ParameterSetName)
            {
                case "ListLogSet":
                    break;

                case "ListProviderSet":
                    break;

                case "GetProviderSet":
                    {
                        result.Append(queryListOpen);
                        uint queryId = 0;

                        foreach (string log in _providersByLogMap.Keys)
                        {
                            string providerFilter = AddProviderPredicatesToFilter(_providersByLogMap[log]);
                            result.AppendFormat(CultureInfo.InvariantCulture, queryTemplate, new object[] { queryId++, log, providerFilter });
                        }

                        result.Append(queryListClose);
                    }

                    break;

                case "GetLogSet":
                    {
                        const int WindowsEventLogAPILimit = 256;
                        if (_logNamesMatchingWildcard.Count > WindowsEventLogAPILimit)
                        {
                            string msg = _resourceMgr.GetString("LogCountLimitExceeded");
                            Exception exc = new(string.Format(CultureInfo.InvariantCulture, msg, _logNamesMatchingWildcard.Count, WindowsEventLogAPILimit));
                            ThrowTerminatingError(new ErrorRecord(exc, "LogCountLimitExceeded", ErrorCategory.LimitsExceeded, null));
                        }

                        result.Append(queryListOpen);
                        uint queryId = 0;
                        foreach (string log in _logNamesMatchingWildcard)
                        {
                            result.AppendFormat(CultureInfo.InvariantCulture, queryTemplate, new object[] { queryId++, log, FilterXPath });
                        }

                        result.Append(queryListClose);
                    }

                    break;

                case "FileSet":
                    {
                        result.Append(queryListOpen);
                        uint queryId = 0;
                        foreach (string filePath in _resolvedPaths)
                        {
                            string properFilePath = filePrefix + filePath;
                            result.AppendFormat(CultureInfo.InvariantCulture, queryTemplate, new object[] { queryId++, properFilePath, FilterXPath });
                        }

                        result.Append(queryListClose);
                    }

                    break;

                case "HashQuerySet":
                    result.Append(BuildStructuredQueryFromHashTable(eventLogSession));
                    break;

                default:
                    WriteDebug(string.Create(CultureInfo.InvariantCulture, $"Invalid parameter set name: {ParameterSetName}"));
                    break;
            }

            WriteVerbose(string.Format(CultureInfo.InvariantCulture, _resourceMgr.GetString("QueryTrace"), result.ToString()));

            return result.ToString();
        }

        //
        // BuildXPathFromHashTable() build xpath from hashtable
        //
        private string BuildXPathFromHashTable(Hashtable hash)
        {
            StringBuilder xpathString = new(string.Empty);
            bool bDateTimeHandled = false;

            foreach (string key in hash.Keys)
            {
                string added = string.Empty;

                switch (key.ToLowerInvariant())
                {
                    case hashkey_logname_lc:
                    case hashkey_path_lc:
                    case hashkey_providername_lc:
                        break;
                    case hashkey_id_lc:
                        added = HandleEventIdHashValue(hash[key]);
                        break;

                    case hashkey_level_lc:
                        added = HandleLevelHashValue(hash[key]);
                        break;

                    case hashkey_keywords_lc:
                        added = HandleKeywordHashValue(hash[key]);
                        break;

                    case hashkey_starttime_lc:
                        if (bDateTimeHandled)
                        {
                            break;
                        }

                        added = HandleStartTimeHashValue(hash[key], hash);

                        bDateTimeHandled = true;
                        break;

                    case hashkey_endtime_lc:
                        if (bDateTimeHandled)
                        {
                            break;
                        }

                        added = HandleEndTimeHashValue(hash[key], hash);

                        bDateTimeHandled = true;
                        break;

                    case hashkey_data_lc:
                        added = HandleDataHashValue(hash[key]);
                        break;

                    case hashkey_userid_lc:
                        added = HandleContextHashValue(hash[key]);
                        break;

                    case hashkey_supress_lc:
                        break;
                    default:
                        {
                            //
                            // None of the recognized values: this must be a named event data field
                            //
                            // Fix Issue #2327
                            added = HandleNamedDataHashValue(key, hash[key]);
                        }

                        break;
                }

                if (added.Length > 0)
                {
                    if (xpathString.Length != 0)
                    {
                        xpathString.Append(" and ");
                    }