Parsing Windows event log files (.evtx) using Python
Recently I came across a problem in which I had to convert .evtx files (Windows Event Log files) to a human readable format like XML, CSV, JSON etc.
There’s this popular and only working parser that I know about python-evtx. It parses .evtx files to XML format.
These are the steps which I followed:
Clone the python-evtx directory in your system.
git clone https://github.com/williballenthin/python-evtx.git
Go into the cloned directory.
Install the libraries
python3 setup.py install
Go to the scripts directory inside python-evtx.
Run the following command if you just have one file which you want to convert.
python3 evtx_dump.py /mnt/data/alisha/logs/dc/security.evtx
In my case, I had folders inside folders which had .evtx files to convert, so I did:
1 2 3 4 5
for file in $(find /mnt/data/alisha/logs/ -iname "*.evtx") do python3 evtx_dump.py $file > /mnt/data/alisha/parsed-evtx/`basename "$file"`.xml echo "$file: $?" >> conversion.log done
It will first check every file inside the logs folder for .evtx extension and run evtx_dump.py on every file thereafter storing the
.xml in a new folder, i.e., parsed-evtx. If it is not able to parse a file into XML due to some error, the filename will get saved in conversion.log.
I hope this will help someone!