grokevt-parselog(1)

💖 grokevt-parselog — the manual page, but make it make sense 💖

okay bestie, welcome to the grokevt-parselog(1) manual page ✨ this is a real Unix tool from the File Conversion Utilities fam, and I'm gonna walk you through every single flag like we're texting at 2am 🫶

---

🌸 NAME 🌸

grokevt-parselog — parses a windows event log and generates human-readable output based on message resources stored in a database. periodt.

---

✨ SYNOPSIS ✨

grokevt-parselog -?|--help

grokevt-parselog -l database-dir

grokevt-parselog -m database-dir log-type

grokevt-parselog [-v] [-H] [-h] database-dir log-type

---

🦋 DESCRIPTION 🦋

so grokevt-parselog reads a windows event log (a .evt file, iykyk) and combines that info with message templates and other resources chillin' in a pre-generated database. then it prints the whole thing to stdout in comma-separated values (CSV) format. literally that's it, that's the vibe 💅

⚠️ real talk: the database has to be created first, by grokevt-builddb(1). no database, no party. 🙈

---

🎀 ARGUMENTS 🎀

• database-dir — this is the directory where the database lives. currently, the actual log files from the original system are also stored in this directory tree. so it's giving organized, we love that for us 🌸
• log-type — this is the windows name for the log. by default windows ships with these logs:

Application
Security
System

but other software (third party girlies 👑) may have created more. use the -l option to print a list of all available log types. and heads up: the log names are case-sensitive. don't be out here typing application and wondering why nothing works, bestie 😭

---

💅 OPTIONS 💅

• -? — prints a basic usage statement. short, sweet, iconic.
• --help — same as -?. twins fr fr.
• -l — log list mode. lists the logs available in the specified database. it's giving menu 🍓
• -m — meta information mode. lists meta information stored in the header of the specified log file. does not print any actual log records. (format of output in this mode is still subject to change — so don't get too attached, it's lowkey in its flop era 🫠)
• -v — verbose mode. prints status messages to stderr, which can be helpful for debugging. the way it just tells you things? obsessed.
• -h — prints a header row at the top of the CSV output containing labels for each column. (this is the default behavior.) she's the main character, she shows up whether you ask or not 💖
• -H — disables the printing of a header row. useful when grokevt-parselog is used in a script. no header, no problem, clean output energy ✨

---

🌈 OUTPUT 🌈

okay so the output format is compatible with programs (like spreadsheets 📊) that understand the de-facto CSV standard format — but it's additionally constrained in that each log entry is written to a single line. one entry, one line, no exceptions.

also, special characters and non-printable characters are encoded using a URL-like encoding format of "%XX" where XX are the hexadecimal digits of an encoded character. new line characters and other special characters, along with binary data, get encoded this way so that using grep(1) and similar command line tools stays easy. it's giving thoughtful 🧚

---

🌟 EXAMPLES 🌟

to list all available logs types stored in ~/example.grokevt:

grokevt-parselog -l ~/example.grokevt

to read the Application log from the database stored in ~/example.grokevt and print it to stdout:

grokevt-parselog ~/example.grokevt Application

to read the System log from the database stored in ~/example.grokevt and print it to stdout without a header, and with verbosity turned on:

grokevt-parselog -v -H ~/example.grokevt System

---

💀 BUGS 💀

• probably a few. this script has not been extensively tested with some guest platforms. not me being honest about my flaws 🙈
• the file event log file format is pretty well understood and implemented, but some diabolical wrapped, dirty, or fragmentary logs may not be correctly parsed. diabolical. 😭
• unicode support is currently limited. any suggestions on how to better handle unicode output would be appreciated. please send help, and by help I mean patches 🫶

---

👑 CREDITS 👑

originally written by Jamie French. converted to Python and extended by Timothy D. Morgan. Andreas Schuster has contributed greatly to the understanding of the event log format. legends, all of them ✨

---

📜 LICENSE 📜

please see the file "LICENSE" included with this software distribution.

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License version 3 for more details.

fr fr, no warranty, bestie. read the GPLv3, it's giving legally binding 💅

---

🔥 SEE ALSO 🔥

grokevt(7) grokevt-addlog(1) grokevt-builddb(1) grokevt-dumpmsgs(1) grokevt-findlogs(1) grokevt-ripdll(1)

---

and that's the whole page, bestie 💖 this one's from the File Conversion Utilities, dated 20 June 2011, and it's filed under grokevt-parselog(1). go parse some logs, you absolute icon 👑✨