Event Log Parser

The event log parser can be used to parse *.evtx files. Evtx file parsing is based on the event log classes provided by Microsoft in the System.Diagnostics.Eventing.Reader namespace. Unfortunately, experience suggests that this library can be both slow and unreliable. For this reason, the preferred solution for reading event log entries is via a CSV file export. This documentation will cover both a CSV file export as well as the event log parser.

CSV File Export

To export your event log entries as a CSV file the first thing you need to do is open event viewer and select the log category that you want to export. Note that log entries will be exported as they appear in the log viewer grid. Changes made to column sorting will be preserved.

With your event viewer open right click on the target log category and select "Save All Events As...".

When prompted enter a name for your new CSV file and select "CSV (Comma Seperated)" as the saved type.

Finally click "Save" to export the event log entries.

Before we open our new CSV log file in LogViewPlus, we need to configure the application so it can parse the CSV file. To do this go to Settings -> Parser Mappings and click 'Add'. In the parser configuration dialog enter a filename pattern which will match the file name given to your CSV file. Next, set the parser type to DsvParser and parser arguments to: %p,%d,%S{Source},%S{Event ID},%S{Task Category},%m%n as shown.

Click Save followed by OK to save the parser settings.

We are now ready to open the CSV export file we created earlier. Opening this file in LogViewPlus will show all of the exported events in the log entry grid. Note that future CSV event log exports will need separate configuration if the filename patterns do not match.

EVTX File Export

Please note that, as stated earlier, due to performance and reliability issues the preferred method for exporting event log entries is via CSV as discussed above.

To export your event log entries as a EVTX file the first thing you need to do is open event viewer and select the log category that you want to export. Next, right click on the target category and select "Save All Events As...".

When prompted enter a name for your new EVTX file and select "Event Files" as the saved type.

Finally click "Save" to export the event log entries. The exported EVTX file can be opened in LogViewPlus immediately without any further configuration.

< >