# aardio 范例: 查询系统日志



```aardio
//查询系统日志 
import com.wmi;
import console.int; 
import sys.acl;
 
for event in com.wmi.eachProperties(`SELECT * FROM Win32_NTLogEvent WHERE
	 Logfile = "System" AND ( EventCode=7001 OR EventCode=7002 OR EventCode=6005 OR EventCode=6006 )` ) {
/*
	console.log( "Category: ", event.Category);
 	console.log( "Computer Name: ", event.ComputerName);
 	console.log( "Event Code: ", event.EventCode);
 	console.log( "Message: ", event.Message);
 	console.log( "Record Number: ", event.RecordNumber);
 	console.log( "Source Name: ", event.SourceName); 
 	console.log( "Event Type: ", event.Type);
 	console.log( "User: ", event.User);
 	console.dumpTable(event)
*/

	// WMI 使用 CIM 格式时间
 	var tm = time.cim( event.TimeWritten ).local();
 	tm.format = "%Y/%m/%d %H:%M:%S";
 	
 	if(event.EventCode==7001 && event.SourceName=="Microsoft-Windows-Winlogon"){
 		var idx,sid = table.find(event.InsertionStrings,lambda(v) string.startsWith(v,"S-"));
 		var userName = sys.acl.sidStringToUserName(sid); 
 		
 		console.log(tm,userName + " 登录成功") 		
 	} 
 	if(event.EventCode==7002 && event.SourceName=="Microsoft-Windows-Winlogon"){
 		var idx,sid = table.find(event.InsertionStrings,lambda(v) string.startsWith(v,"S-"));
 		var userName = sys.acl.sidStringToUserName(sid); 
 		
 		console.log(tm,userName, " 已注销" ) 		
 	} 
 	elseif(event.SourceName=="EventLog") {
 		console.log(tm,event.Message,event.SourceName,event.EventCode)
 		if(event.EventCode == 6005) console.more(1)
 	} 
}  
 
```