我正在尝试自动解析我最初在我的Python程序中打开的日志文件,以便在我开始从文件本身读取实际行之前,它的输出是人类可读的格式。我该怎么做?
with open('/var/log/audit/audit.log') as audit_raw:
audit_formatted=subprocess.call(["ausearch", "-i", audit_raw])
line = audit_formatted.readline()
我尝试这样的错误消息:
Traceback (most recent call last):
File "./email_script.py", line 29, in <module>
audit_log=subprocess.call(["ausearch", "-i", audit_raw])
File "/usr/lib/python3.6/subprocess.py", line 267, in call
with Popen(*popenargs, **kwargs) as p:
File "/usr/lib/python3.6/subprocess.py", line 709, in __init__
restore_signals, start_new_session)
File "/usr/lib/python3.6/subprocess.py", line 1275, in _execute_child
restore_signals, start_new_session, preexec_fn)
TypeError: expected str, bytes or os.PathLike object, not _io.TextIOWrapper
你用正确的参数调用ausearch并解析它的输出。
在这里被盗:Python library for handling linux's audit.log?(这是一个要求图书馆认可的离场问题)并可能从SO中消失 - 这就是为什么我决定反对“重复”。
import subprocess def read_audit(before,now,user): auparam = " -sc EXECVE" cmd = "ausearch -ts " + before.strftime('%H:%M:%S') + " -te " + now.strftime('%H:%M:%S') + " -ua " + user + auparam p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE) res = p.stdout.read().decode() return res