6

I have a .evtx (Windows Event Log) file, and want to view it on Linux.

Requirements:

  • Free
  • Easy to install/run
  • Works on Linux
  • Command line tools are OK, GUIs are OK
5

I found something that meets all your requirements, the only drawback is that the logs are a bit hard to parse by a human.

python-evtx (GitHub repo) is free/libre and is easy to install using pip install python-evtx. Use the command

python /usr/bin/evtx_dump.py some.evtx > some.xml

You'll end up with an XML with the logs content.

3

On Debian and derived distributions, there is also evtxexport :

evtxexport is a utility to export items stored in a Windows XML EventViewer Log (EVTX) file

It is part of the "libevtx-utils" package.

apt install libevtx-utils

(See also my answer here with a few alternatives)

1

I have found another utility for exporting evtx log to XML/JSON format: EVTX

Self-described as "A cross-platform parser for the Windows XML EventLog format".

  • Supports XML and JSON outputs
  • Supports some basic recovery of missing records/chunks
  • Claims to be much faster than python-evtx and golang-evtx
  • License: Apache or MIT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.