Play the old format event log analysis under Vista/Windows7

[Note, this article is not suitable for junior computer users]

If there is one, a friend tells you that his computer has a problem, and you may need to analyze the event log of its system. After all, in the Windows system, the system event log records too much information, application usage, crashes and other records, Windows system various event records and so on. However, when your friend sends the log in his Windows directory and you want to view and analyze it, I find that the event log crashes!

What is going on here?

The reason is very simple. The event log before Vista is the .evt file, Vista and the .evtx file!

We can use the Log Parser 2.2 provided by Microsoft (click to enter the official Microsoft page), it can parse the respective supported formats on the corresponding system, the parsing command is: logparser -i:EVT "SELECT * INTO A.csv FROM b.evt" But if you parse the .evt format log on Vista, Windows Server 2008, Windows 7, and later systems, you may be prompted to crash the event log. You need to convert the .evt format to .evtx format. Fortunately, The Vista and later systems provide the Wevtutil-Windows Events Command Line Utility tool!

Run the command: wevtutil epl application.evt application.evtx /lf:true to convert.

wevtutil The prompts in the system are in English,:

Windows Events Command Line Utility.

Enables you to retrieve information about event logs and Publishers, installand Uninstall event manifests, run queries, and export, archive, and clear logs.

Usage:

You can use either the short (for example, ep /uni) or long (for example, enum-Publishers /unicode) version of the command and option names. Commands, options and option values ​​are not case-sensitive.

Variables are noted in all upper-case.

wevtutil COMMAND [ ,null,null,3],ARGUMENT [ARGUMENT] ...] [/OPTION: VALUE [/OPTION: VALUE] ...]

Commands:

el