That's true: the select can be skipped and the regular expression can be directly injected in the insert command. I didn't really wanted to fiddle also with the escapes
Get-EventLog -LogName "Security" | ? { $_.InstanceID -eq 4648 } | % { Invoke-Sqlcmd -Query "INSERT INTO tempdb.dbo.FailedLogons VALUES ($($_.Index), '$($_.TimeGenerated)', '$($_.MachineName)', '$([regex]::match($_.Message, `"Account Name:\s*(.*)\x0d\x0a`").Groups[1].Value)');" }
There is pretty much nothing you can't do in Powershell. It has an innovative object pipeline system and excellent syntax. The learning curve is high but what powerful programming language doesn't have a high learning curve?
bash...
Probably the hardest thing to learn in the *nix scripting world is sed.
I wrote a menuing system for a Xenix minicomputer back in the early 1990s in straight sh, never having touched it or the Unix tool set before, in a couple of hours. And I can tell you I ain't no genius.
Try do anything vaguely useful in Powershell without prior knowledge in a couple of hours. It is a gawdawful horror story, a good example of the insane overkill that Microsoft applies to simple problems. It keeps the MCSE's employed with the bizarre range of esoteric and overly-complicated solutions, but when you're just trying to move some data around from tool to tool or piping some output through a regex evaluator on its way to a SQL RDBMS, you end up going "What the fuck is wrong with those people in Redmond?"
Just as a reality check, here's a single command line that:
- gets the Windows security Event Log
- filters for failed logon events (4648)
- extracts some fields from the events, in some cases these are exposed as simple properties of the streaming objects, in one other it's using RexEx, with a named capturing group, to find the user name in the message
- inserts the data in a SQL RDBMS
Get-EventLog -LogName "Security" | ? { $_.InstanceID -eq 4648 } | Select Index, TimeGenerated, MachineName, @{Name="AccountName"; Expression={(([regex]"Account Name:\s*(?.*)\x0d\x0a").Match($_.Message) | ? {$_.Success}).Groups['AccountName'].Value}} | % { Invoke-Sqlcmd -Query "INSERT INTO tempdb.dbo.FailedLogons VALUES ($($_.Index), '$($_.TimeGenerated)', '$($_.MachineName)', '$($_.AccountName)');" }
I'm no genius either, have no MCSE, been into Xenix last century, but oddly enough I ended up with a completely different opinion of the people in Redmond.
Just to be sure I'm not making up things, this is the database schema to test it with SQL Server:
CREATE TABLE tempdb.dbo.FailedLogons (
LogIndex int NOT NULL PRIMARY KEY
, TimeGenerated datetime NOT NULL
, MachineName nvarchar(16) NOT NULL
, AccountName nvarchar(256) NOT NULL
)
Oh, and you need to make sure SQL Server PowerShell provider is loaded in your environment for the Invoke-Sqlcmd commandlet to be available.
Want to read a binary file? Get-Content -Path C:\binary.file -Encoding Byte
Wow, that is powerful! Contrast with the same thing, much more difficult to express in Unix:
cat [filename]
[/sarcasm]
Don't worry, we are also lazy:
Get-Alias -Definition Get-Content
Alias cat Get-Content
Alias gc Get-Content
Alias type Get-Content
;-)
Do yourself a huge favor, though - get a decent editor. While Windows has a simple notepad app, there is no context highlighting, in-line completion, or other helpful tools for looking at script code.
Adding another one to the list which is free, has command completion and debugging: PowerGui Editor for Quest http://www.powergui.org/
You do know that the original TF was written for Quake, right? IMO, it's still the best class and objective based gameplay ever written. TFC was merely a rewrite for the Half-Life engine. The only other mod that ever came close was Weapons Factory (written for the Q2 engine), and that borrowed a lot of concepts from TF.
I never played the original TF (just seen it) but I think Q3F and later ETF were awesome. Much better than TF2 for gameplay and overall fun.
First of all, please not that I'm not suggesting they where right or anything.
I said they were obliged to investigate because people filed accusations. During investigations, prosecutors come to a point where they formulate concrete indictments against people and usually continue to investigate. At the end they file everything and a trial can begin. This is very roughly how it works and how it supposedly worked it this case (I'm basing my comments on different articles from the press here in Italy).
Were these geologists negligent? Given our current understanding of earthquakes, we can off-handedly state, "probably not", but we aren't sure. Is it unreasonable for somebody to want a court to investigate further, given the scale and scope of the damage? Not really.
Not only that. People should understand some basics of the Italian law system before jumping to conclusions, making comparisons and pretending everyone is an idiot (I'm not referring to you).
When authorities are notified or simply become aware of crimes, they are obliged to investigate. In this case there were several accusations made by people and prosecutors were obliged to investigate. Just to give some more perspective, charges are for homicide and other related crimes. The researcher that was investigated in the past for saying there would have been an earthquake, was charged (if I remember correctly) for procured alarm to authorities (still a crime).
Beside the obligation to investigate, I also agree with you that is not necessarily unreasonable to investigate further. I'm pretty sure these guys will be discharged and the outcome of the trial may be helpful in future to prevent similar things to happen (both geologist trying to be less conservative and people being discouraged to make criminal accusations for nothing).
This helps to understand the technical part of it, but of course there's more: the political part.
Lately the civil protection department has gone through several scandals related to rebuilding activities of the area and it's close to the current government. Part of the population is pissed off because: they lost relatives, rebuilding is happening slowly and lot of promises remained just promises. The judiciary bench is often accused by the right wing (current government) to have the majority of judges being close to the left wing and to try to overcome the government.
So, depending on the political orientation, people think either that prosecutors are just doing their jobs, or that they are trying to put pressure on the government accusing the civil protection. You may feel a bit puzzled at this point asking yourself what's the problem if, after all, they are simply following the law that obliges them to investigate. A common argument by right wing people is that there are simply too many notifications of crimes and accusations to investigate on all of them and the judiciary bench selects them (or better give priorities) based on a political agenda.
So, don't think this is only a matter that has to do with science. It has more to do with the judiciary system and politics.
Now people can feel free to think everyone here is an idiot
It's amazing that the most relevant answer is buried under ton of irrelevant stuff.
Just try it, I'm sure it's what you are looking for. Only major thing missing: facial recognition to assist tagging people. For that, you can use Live Photogallery, it's not as good as Picasa but at least it stores the metadata in documented XMP estensions (Picasa store facial information inside sidecar files but they contain references to unique ids in their database).
I canceled the Sky satellite contract years ago. First they started with documentary channels (the only ones I was really interested in) with ads about other programs. Then after a year or so they started with generic advertisement.
I simply canceled everything and gave them a hard time to get back the leased decoder. I'm not going to pay for advertisement that's it.
Nowadays, I simply look a the news on the free channels (luckily here they are not interrupted by ads. Instead, I now read a *lot* more and can dedicate time to the kids to do something more intelligent that passively looking at the box full of crap.
"Sometimes insanity is the only alternative" -- button at a Science Fiction convention.
