grokevt-builddb(1)

✨ grokevt-builddb ✨

okay bestie, welcome to the grokevt-builddb(1) page 💖 this is one of the grokevt file conversion utilities, and she's a lil workhorse. let's get into it 🫶

---

🌸 NAME 🌸

grokevt-builddb — builds a database tree based on a single windows system, for the purpose of event log conversion. no cap, that's literally her whole job 💅

---

🎀 SYNOPSIS 🎀

grokevt-builddb [ -c CSID ] config-profile output-dir

---

🦋 DESCRIPTION 🦋

so here's the tea, bestie ☕ grokevt-builddb pulls in grokevt-ripdll(1) and reglookup(1), plus all the info chilling in the configuration files, and uses all of that to extract every necessary lil detail from a windows installation so event log files can be converted. she reads the registry to figure out where the critical DLLs live and where the event log files themselves are hiding 🔍✨

all of that — plus other registry info — gets stashed into a directory structure that acts as a kind of flat-file database. and then? that database can be used by grokevt-parselog(1) to generate human-readable output. iconic behavior honestly 👑

💡 the key to successfully running this utility is proper configuration. please go read grokevt(7) for the info on what needs to be configured. do not skip this. i'm begging 🙏

---

🌈 ARGUMENTS 🌈

• config-profile — this is the name of the configuration profiles stored in the global configuration directory, under the directory 'systems'. peep grokevt(7) for the full deets on how to properly configure a system profile 🧚
• output-dir — the path to where the output database lives. ⚠️ and heads up: if anything already exists in this directory, it may be overwritten or deleted. so like. be normal about what you point this at, okay? 😭

---

💅 OPTIONS 💅

• -c CSID — this one lets you explicitly set which ControlSet in the registry gets used to extract event log message mappings. if you specify it, it must be a positive decimal integer. if you don't specify it, grokevt-builddb will try to determine the best ControlSet by looking at the most recent CurrentControlSet, which is stored in the system registry under the path '/Select/Current'. most users should just ignore this option entirely, unless there's a specific reason the last CurrentControlSet shouldn't be used. fr fr, leave it alone unless you know why you're here 🫶

---

⭐ EXAMPLES ⭐

to generate a database at ~/win2k.grokevt based on the system configuration profile win2k:

grokevt-builddb win2k ~/win2k.grokevt

to repeat the last command, but instead use registry information explicitly from /ControlSet002:

grokevt-builddb -c 2 win2k ~/win2k.grokevt

see? easy. slay 💖

---

💀 BUGS 💀

probably a few. ngl. 😬 this script has not been extensively tested with some guest platforms.

also: the databases built with this script may not be portable to other systems, and that depends on the database drivers installed and used in Python. so like, don't assume you can just carry her around 🥲

---

👑 CREDITS 👑

Written by Timothy D. Morgan. 🫶

---

📜 LICENSE 📜

please see the file "LICENSE" included with this software distribution.

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License version 3 for more details. (yes that's the all-caps part, it means it 🫡)

---

🔥 SEE ALSO 🔥

grokevt(7) grokevt-addlog(1) grokevt-dumpmsgs(1) grokevt-findlogs(1) grokevt-parselog(1) grokevt-ripdll(1) reglookup(1)

---

File Conversion Utilities 🎀 20 June 2011 🎀 that's the vibe, bestie — go build that database, you've got this 💖✨🦋