慕運(yùn)維8079593
2021-12-26 15:30:09
我正在嘗試自動(dòng)解析最初在 Python 程序中打開的日志文件,以便在我開始從文件本身讀取實(shí)際行之前,其輸出采用人類可讀的格式。我該怎么做?with open('/var/log/audit/audit.log') as audit_raw: audit_formatted=subprocess.call(["ausearch", "-i", audit_raw]) line = audit_formatted.readline()當(dāng)我嘗試這樣做時(shí)的錯(cuò)誤消息:Traceback (most recent call last): File "./email_script.py", line 29, in <module> audit_log=subprocess.call(["ausearch", "-i", audit_raw]) File "/usr/lib/python3.6/subprocess.py", line 267, in call with Popen(*popenargs, **kwargs) as p: File "/usr/lib/python3.6/subprocess.py", line 709, in __init__ restore_signals, start_new_session) File "/usr/lib/python3.6/subprocess.py", line 1275, in _execute_child restore_signals, start_new_session, preexec_fn)TypeError: expected str, bytes or os.PathLike object, not _io.TextIOWrapper
1 回答

白板的微信
TA貢獻(xiàn)1883條經(jīng)驗(yàn) 獲得超3個(gè)贊
您使用正確的參數(shù)調(diào)用ausearch并解析其輸出。
在這里被盜:用于處理 linux 的 audit.log 的 Python 庫?(這是一個(gè)要求圖書館認(rèn)可的題外問題)并且可能會(huì)從 SO 中消失 - 這就是我決定反對(duì)“重復(fù)”的原因。
方尖碑回答:
import subprocess
def read_audit(before,now,user):
auparam = " -sc EXECVE"
cmd = "ausearch -ts " + before.strftime('%H:%M:%S') + " -te " + now.strftime('%H:%M:%S') + " -ua " + user + auparam
p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
res = p.stdout.read().decode()
return res
添加回答
舉報(bào)
0/150
提交
取消