LogViewPlus Support » LogViewPlus Support » Help & Support » Time Offset for .evtx files

Time Offset for .evtx files

AndreasP — Tue, 08 Jun 2021 18:29:33 GMT

Hi Toby,

I just wanted to apply a time offset to an windows event log file (.evtx). However the menu item is disabled for this file.
Is this by intention or a bug?

Regards
Andreas

RE: Time Offset for .evtx files

LogViewPlus Support — Tue, 08 Jun 2021 18:29:33 GMT

Glad that helped Andreas - thanks for letting me know!

Toby

RE: Time Offset for .evtx files

AndreasP — Tue, 08 Jun 2021 18:04:36 GMT

Hi Toby,

I used the new feature today in an analysis and it worked!

Thanks!

Andreas

RE: Time Offset for .evtx files

LogViewPlus Support — Mon, 07 Jun 2021 08:31:00 GMT

Hi Andreas,

I just wanted to let you know that we have now released LogViewPlus v2.5.19 as a beta release. This release adds time offset support to log readers and data sources (including EVTX files).

Hope that helps. Thanks for bringing this issue to our attention!

Toby

RE: Time Offset for .evtx files

LogViewPlus Support — Sun, 16 May 2021 06:50:24 GMT

Hi Andreas,

This is by design, but it is probably something that we need to revisit. The issue here is that binary log files are processed differently from other log file types and support for post-processors (like the Time Offset) was never added. Currently, the EVTX reader is the only binary parser that ships with LogViewPlus.

We currently have a version of LogViewPlus in BETA, the release after this one is going to be focused on improved parsing. I think it is a good time to review the post processor support.

Thanks for bringing this issue to our attention.

Toby