NAME

       grokevt-parselog  -  Parse a windows event log and generate human-readable output based on
       message resources stored in a database.

SYNOPSIS

       grokevt-parselog -?|--help

       grokevt-parselog -l database-dir

       grokevt-parselog -m database-dir log-type

       grokevt-parselog [-v] [-H] [-h] database-dir log-type

DESCRIPTION

       grokevt-parselog reads a windows event log (.evt file) and combines that information  with
       messages  templates  and  other resources stored in a pre-generated database. This is then
       printed to stdout in a comma-separated values (CSV) format.  The database  must  first  be
       created by grokevt-builddb(1).

ARGUMENTS

       database-dir
              This is the directory where the database is stored. Currently, the actual log files
              from the original system are also stored in this directory tree.

       log-type
              This is the windows name for the log. By default windows has the following logs:

                           Application
                           Security
                           System

              But others may have been created by third party software.  Use  the  -l  option  to
              print a list of all available log types. (The log names are case-sensitive.)

OPTIONS

       -?     Prints a basic usage statement.

       --help Same as -?.

       -l     Log list mode. Lists the logs available in the specified database.

       -m     Meta information mode. Lists meta information stored in the header of the specified
              log file. Does not print any actual log records. (Format of output in this mode  is
              still subject to change.)

       -v     Verbose mode. Prints status messages to stderr, which can be helpful for debugging.

       -h     Prints a header row at the top of the CSV output containing labels for each column.
              (This is the default behavior.)

       -H     Disables the printing of a header row. This is useful when grokevt-parselog is used
              in a script.

OUTPUT

       While the output format is compatible with programs (such as spreadsheets) that understand
       the de-facto CSV standard format, the format is additionally constrained in that each  log
       entry  is  written to a single line. Also, special characters and non-printable characters
       are encoded using a URL-like encoding format of "%XX" where XX are the hexadecimal  digits
       of  an  encoded  character.  New  line  characters and other special characters along with
       binary data are encoded this way to allow for easy use of grep(1) and similar command line
       tools.

EXAMPLES

       To list all available logs types stored in '~/example.grokevt':

              grokevt-parselog -l ~/example.grokevt

       To read the 'Application' log from the database stored in '~/example.grokevt' and print it
       to stdout:

              grokevt-parselog ~/example.grokevt Application

       To read the 'System' log from the database stored in '~/example.grokevt' and print  it  to
       stdout without a header, and with verbosity turned on:

              grokevt-parselog -v -H ~/example.grokevt System

BUGS

       Probably a few. This script has not been extensively tested with some guest platforms.

       The  file  event  log  file  format  is  pretty  well understood and implemented, but some
       diabolical wrapped, dirty, or fragmentary logs may not be correctly parsed.

       Unicode support is currently limited. Any suggestions on  how  to  better  handle  unicode
       output would be appreciated.

CREDITS

       Originally  written  by  Jamie  French.   Converted  to  Python and extended by Timothy D.
       Morgan.  Andreas Schuster has contributed greatly to the understanding of  the  event  log
       format.

LICENSE

       Please see the file "LICENSE" included with this software distribution.

       This  program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
       without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR  PURPOSE.
       See the GNU General Public License version 3 for more details.

SEE ALSO

       grokevt(7)  grokevt-addlog(1)  grokevt-builddb(1)  grokevt-dumpmsgs(1) grokevt-findlogs(1)
       grokevt-ripdll(1)