grokevt-parselog(1)

NAME
grokevt-parselog - Parse a windows event log and generate human-readable output based on message resources stored in a database.

SYNOPSIS
grokevt-parselog -?|--help

grokevt-parselog -l database-dir

grokevt-parselog -m database-dir log-type

grokevt-parselog [-v] [-H] [-h] database-dir log-type

DESCRIPTION
grokevt-parselog reads a windows event log (.evt file) and combines that information with messages templates and other resources stored in a pre-generated database. This is then printed to stdout in a comma-separated values (CSV) format. The database must first be created by grokevt-builddb(1).

ARGUMENTS

database-dir
    This is the directory where the database is stored. Currently, the actual log files from the original system are also stored in this directory tree.

log-type
    This is the windows name for the log. By default windows has the following logs:

    \FC
                 Application
                 Security
                 System
                \F[]

    But others may have been created by third party software. Use the -l option to print a list of all available log types. (The log names are case-sensitive.)

OPTIONS

\FC-?\F[]
    Prints a basic usage statement.

\FC--help\F[]
    Same as -?.

\FC-l\F[]
    Log list mode. Lists the logs available in the specified database.

\FC-m\F[]
    Meta information mode. Lists meta information stored in the header of the specified log file. Does not print any actual log records. (Format of output in this mode is still subject to change.)

\FC-v\F[]
    Verbose mode. Prints status messages to stderr, which can be helpful for debugging.

\FC-h\F[]
    Prints a header row at the top of the CSV output containing labels for each column. (This is the default behavior.)

\FC-H\F[]
    Disables the printing of a header row. This is useful when grokevt-parselog is used in a script.

OUTPUT
While the output format is compatible with programs (such as spreadsheets) that understand the de-facto CSV standard format, the format is additionally constrained in that each log entry is written to a single line. Also, special characters and non-printable characters are encoded using a URL-like encoding format of "%XX" where XX are the hexadecimal digits of an encoded character. New line characters and other special characters along with binary data are encoded this way to allow for easy use of grep(1) and similar command line tools.

EXAMPLES
To list all available logs types stored in '~/example.grokevt':

\FC
	  grokevt-parselog -l ~/example.grokevt
        \F[]

To read the 'Application' log from the database stored in '~/example.grokevt' and print it to stdout:

\FC
	  grokevt-parselog ~/example.grokevt Application
        \F[]

To read the 'System' log from the database stored in '~/example.grokevt' and print it to stdout without a header, and with verbosity turned on:

\FC
	  grokevt-parselog -v -H ~/example.grokevt System
        \F[]

BUGS
Probably a few. This script has not been extensively tested with some guest platforms.

The file event log file format is pretty well understood and implemented, but some diabolical wrapped, dirty, or fragmentary logs may not be correctly parsed.

Unicode support is currently limited. Any suggestions on how to better handle unicode output would be appreciated.

CREDITS
Originally written by Jamie French. Converted to Python and extended by Timothy D. Morgan. Andreas Schuster has contributed greatly to the understanding of the event log format.

LICENSE
Please see the file "LICENSE" included with this software distribution.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License version 3 for more details.

SEE ALSO
grokevt(7) grokevt-addlog(1) grokevt-builddb(1) grokevt-dumpmsgs(1) grokevt-findlogs(1) grokevt-ripdll(1)