9

I have a .evtx (Windows Event Log) file, and want to view it on Linux.

Requirements:

  • Free
  • Easy to install/run
  • Works on Linux
  • Command line tools are OK, GUIs are OK

5 Answers 5

6

I found something that meets all your requirements, the only drawback is that the logs are a bit hard to parse by a human.

python-evtx (GitHub repo) is free/libre and is easy to install using pip install python-evtx. Use the command

python /usr/bin/evtx_dump.py some.evtx > some.xml

You'll end up with an XML with the logs content.

4

On Debian and derived distributions, there is also evtxexport :

evtxexport is a utility to export items stored in a Windows XML EventViewer Log (EVTX) file

It is part of the "libevtx-utils" package.

apt install libevtx-utils

(See also my answer here with a few alternatives)

2

I have found another utility for exporting evtx log to XML/JSON format: EVTX

Self-described as "A cross-platform parser for the Windows XML EventLog format".

  • Supports XML and JSON outputs
  • Supports some basic recovery of missing records/chunks
  • Claims to be much faster than python-evtx and golang-evtx
  • License: Apache or MIT
1

If you're open to an online tool, consider Gigasheet (http://gigasheet.co). It's a free tool that allows you to upload and work with EVTX files in a spreadsheet-like rows-and-columns interface.

A video detailing how this is done is here: https://www.youtube.com/watch?v=X-vVSS7Llyw, and a blog post is here: https://www.gigasheet.co/post/online-evtx-parser-and-viewer. Gigasheet is built to work with files up to one billion rows.

Disclosure: I joined Gigasheet in January 2022.

1

evtx (evtx_dump)

Use rust crate evtx. Assuming you have rust installed then run

cargo install evtx

It installs program evtx_dump.

$ evtx_dump.exe --help
EVTX Parser 0.8.1
Utility to parse EVTX files

USAGE:
    evtx_dump [OPTIONS] <INPUT>

Super Speedy Syslog Searcher (s4)

However, evtx_dump does not print the Events in a datetime sorted order, and can only print one .evtx file per run.

Program Super Speedy Syslog Searcher will process multiple .evtx files, and can print all Events in chronological order.

cargo install super_speedy_syslog_searcher

It installs program s4.

$ s4.exe C:\Windows\System32\winevt\Logs

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.