grokevt-addlog(1)

💖 grokevt-addlog — bestie's guide to the grokevt-addlog(1) manual page 💖

okay so listen. this is grokevt-addlog(1), and it's literally the tool that lets you slide a raw event log into a GrokEVT database that already exists. no cap. let's get into it. 🦋

---

✨ NAME ✨

grokevt-addlog — a tool for adding a raw event log to an existing GrokEVT database. that's it, that's the whole vibe. 💅

---

✨ SYNOPSIS ✨

grokevt-addlog database-dir evt-file new-type base-type

four little arguments, one big slay. 🌸

---

✨ DESCRIPTION ✨

so grokevt-addlog takes a raw event log (a .evt file, bestie) and adds it to a pre-built database that was generated by grokevt-builddb(1). 🎀

and here's the cute part: this new log file gets set up to use the message templates of another log — which one? whichever one you pick. you're the main character here. 👑

this tool is primarily useful for processing deleted logs and log fragments found on a system. like, the messy leftovers. the crumbs. 🍓

ok but real talk — it is technically possible to use the database generated from one system with the logs of another system, but this is not recommended for investigations unless no alternatives exist. so like… don't, unless you literally have to. 😭

---

✨ ARGUMENTS ✨

grokevt-addlog uses the following arguments, and yes, you need all four:

• database-dir — the base directory for the database that was generated previously by grokevt-builddb(1). this is home base. 🏠
• evt-file — the file you're adding to the database. the new kid. ✨
• new-type — the new log type/name that evt-file will take on. this is the name you'll need to use later with grokevt-parselog(1) to access the new log. 🫶 heads up: this type must not already exist in the database. if it does, that's a no. 🚫
• base-type — the existing log type that this new log will be based on. the message templates from this type get used with the new log when parsing. this type must exist in the current database. it's giving "you can't sit with us if you're not already here." 💀

---

✨ BUGS ✨

probably several. 🙈 this particular script has not been extensively tested. so… yeah. proceed accordingly, bestie.

---

✨ CREDITS ✨

written by Timothy D. Morgan. thank you for your service. 🫡💖

---

✨ LICENSE ✨

please see the file "LICENSE" included with this software distribution.

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License version 3 for more details. ⚖️ (yes that's the legal scream, keep it.) 😭

---

✨ SEE ALSO ✨

grokevt(7) grokevt-builddb(1) grokevt-dumpmsgs(1) grokevt-findlogs(1) grokevt-parselog(1) grokevt-ripdll(1)

go read those too, iykyk. 📚✨

---

File Conversion Utilities · 20 June 2011 — and that's the whole page, bestie. go forth and add those logs. periodt. 💅🌈👑