Alisha
Alisha Software Engineer at CSIRO's Data61, Python, Javascript, ReactJS, Scala

Parsing Windows event log files (.evtx) using Python

Parsing Windows event log files (.evtx) using Python

Recently I came across a problem in which I had to convert .evtx files (Windows Event Log files) to a human readable format like XML, CSV, JSON etc.

There’s this popular and only working parser that I know about python-evtx. It parses .evtx files to XML format.

These are the steps which I followed:

  • Clone the python-evtx directory in your system.

    1
    
    git clone https://github.com/williballenthin/python-evtx.git
    
  • Go into the cloned directory.

    1
    
    cd python-evtx
    
  • Install the libraries

    1
    
    python3 setup.py install
    
  • Go to the scripts directory inside python-evtx.

    1
    
    cd scripts
    
  • Run the following command if you just have one file which you want to convert.

    1
    
    python3 evtx_dump.py /mnt/data/alisha/logs/dc/security.evtx
    
  • In my case, I had folders inside folders which had .evtx files to convert, so I did:

    1
    2
    3
    4
    5
    
    for file in $(find /mnt/data/alisha/logs/ -iname "*.evtx")
    do
    	python3 evtx_dump.py $file > /mnt/data/alisha/parsed-evtx/`basename "$file"`.xml
    	echo "$file: $?" >> conversion.log
    done
    

    It will first check every file inside the logs folder for .evtx extension and run evtx_dump.py on every file thereafter storing the .xml in a new folder, i.e., parsed-evtx. If it is not able to parse a file into XML due to some error, the filename will get saved in conversion.log.

    I hope this will help someone!

comments powered by Disqus