grokevt-addlog(1)

Usage

grokevt-addlog database-dir evt-file new-type base-type

Overview

grokevt-addlog takes a raw event log (.evt file) and adds it to a pre-built database generated by grokevt-builddb(1). This new log file will be set up to use the message templates of another log, as determined by the user.

This tool is primarily useful for processing deleted logs and log fragments found on a system. While it is possible to use the database generated from one system with the logs of another, this is not recommended for investigations unless no alternatives exist.

Arguments

grokevt-addlog uses the following arguments:

database-dir: The base directory for the database generated previously by grokevt-builddb(1).

evt-file: The file to be added to the database.

new-type: The new log type/name that evt-file will take on. This is the name that will need to be used later with grokevt-parselog(1) to access the new log. This type must not already exist in the database.

base-type: The existing log type that this new log will be based on. The message templates from this type will be used with the new log when parsing. This type must exist in the current database.

Credits

Written by Timothy D. Morgan.

Releases

9 releases since Debian 5.0 (Lenny); the text changed 2 times.

grokevt(7) a collection of scripts built for reading windows event log files. grokevt-builddb(1) Builds a database tree based on a single windows system for the purpose of event log conversion. grokevt-dumpmsgs(1) A tool for dumping the contents of message databases built previously by grokevt-ripdll(1). grokevt-findlogs(1) Attempts to find log file fragments in raw binary files, such as memory dumps and disk images. grokevt-parselog(1) Parse a windows event log and generate human-readable output based on message resources stored in a database. grokevt-ripdll(1) A tool for extracting message resources from a PE-formatted file.

Referred to by

grokevt-ripdll(1) A tool for extracting message resources from a PE-formatted file. grokevt-builddb(1) Builds a database tree based on a single windows system for the purpose of event log conversion. grokevt-dumpmsgs(1) A tool for dumping the contents of message databases built previously by grokevt-ripdll(1). grokevt-findlogs(1) Attempts to find log file fragments in raw binary files, such as memory dumps and disk images. grokevt-parselog(1) Parse a windows event log and generate human-readable output based on message resources stored in a database. grokevt(7) a collection of scripts built for reading windows event log files.