NAME

       grokevt-builddb  -  Builds  a database tree based on a single windows system for the purpose of event log
       conversion.

SYNOPSIS

       grokevt-builddb [ -c CSID ] config-profile output-dir

DESCRIPTION

       grokevt-builddb uses grokevt-ripdll(1) and reglookup(1) along with  information  found  in  configuration
       files  to  extract  all necessary information from a windows installation for the conversion of event log
       files. The registry is read to determine  the  locations  of  critical  DLLs  and  the  event  log  files
       themselves. This, and other information out of the registry is stored in a directory structure which acts
       as a kind of flat-file database. This database can then be used by grokevt-parselog(1) to generate human-
       readable output.

       The  key  to  successfully  running  this  utility  is  proper  configuration.  Please see grokevt(7) for
       information on what needs to be configured.

ARGUMENTS

       config-profile
              This is the name of the configuration profiles stored in the global configuration directory  under
              the  directory  'systems'.  See  grokevt(7) for more details on how to properly configure a system
              profile.

       output-dir
              The path to the location of the output database.  If anything already exists in this directory, it
              may be overwritten or deleted.

OPTIONS

       -c CSID
              This option allows one to explicitly set which ControlSet in the registry is used to extract event
              log message mappings. If specified, this item must be a positive decimal integer.  If unspecified,
              grokevt-builddb  will  attempt  to  determine  the  best  ControlSet by looking at the most recent
              CurrentControlSet, stored in the system registry under the  path  '/Select/Current'.   Most  users
              should  ignore this option unless there is a specific reason why the last CurrentControlSet should
              not be used.

EXAMPLES

       To generate a database at '~/win2k.grokevt' based on the system configuration profile 'win2k':

             grokevt-builddb win2k ~/win2k.grokevt

       To repeat the last command, instead using registry information explicitly from /ControlSet002:

             grokevt-builddb -c 2 win2k ~/win2k.grokevt

BUGS

       Probably a few. This script has not been extensively tested with some guest platforms.

       The databases built with this script may not be portable to other  systems,  depending  on  the  database
       drivers installed and used in Python.

CREDITS

       Written by Timothy D. Morgan.

LICENSE

       Please see the file "LICENSE" included with this software distribution.

       This  program  is  distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even
       the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU  General  Public
       License version 3 for more details.

SEE ALSO

       grokevt(7)   grokevt-addlog(1)   grokevt-dumpmsgs(1)   grokevt-findlogs(1)  grokevt-parselog(1)  grokevt-
       ripdll(1) reglookup(1)