6

I have a .evtx (Windows Event Log) file, and want to view it on Linux.

Requirements:

  • Free
  • Easy to install/run
  • Works on Linux
  • Command line tools are OK, GUIs are OK
4

I found something that meets all your requirements, the only drawback is that the logs are a bit hard to parse by a human.

python-evtx (GitHub repo) is free/libre and is easy to install using pip install python-evtx. Use the command

python /usr/bin/evtx_dump.py some.evtx > some.xml

You'll end up with an XML with the logs content.

3

On Debian and derived distributions, there is also evtxexport :

evtxexport is a utility to export items stored in a Windows XML EventViewer Log (EVTX) file

It is part of the "libevtx-utils" package.

apt install libevtx-utils

(See also my answer here with a few alternatives)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.