How to convert .evtx eventlog to csv

Question

My Windows service should save the contents of one event log to a file. This is done by EventLogSession.ClearLog. However, I cannot force it to automatically save the event log in CSV. The saved format is EVTX.

EventLogSession els = new EventLogSession(); //stel de filename samen door het appdata pad te combinen met een tempfile name string tempData = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "templog.csv"); // Clears all the events and archives them to the .evtx file els.ClearLog(eventLogName, tempData); // Backup File Path 

How can I make the EventlogSession class save directly to CSV or if this is not possible. How to convert EVTX to CSV (using C # or VB.net)

Thanks!

Answer 1

It turned out that all existing solutions do not meet my requirements. I just need a tool that takes evtx as input and exports csv. No more, no less. I built it myself and everything works fine. It is called EVTX2CSV

You can download it here: http://essaver.net/evtxecsv or directly through http://www.essaver.net/downloads/setupevtx2csv.exe

Answer 2

This is fairly easy to do with the API provided by Log Parser.

Download and Install Log Parser 2.2

Add a link to the COM library "MS Utility 1.0 Type Library - LogParser Interface Collection". Searching for a magazine has significantly shortened the list.

Change the Reference properties so that it does not embed Interop types. If you do not, you will get compilation errors as follows: Interop type "MSUtil.COMCSVOutputContextClassClass" cannot be embedded. Use the appropriate interface instead.

The contents of the LogParser help file has a great API link, but I included parts that I used inline with the code.

 using System; using MSUtil; namespace LogParserTest { using LogQuery = LogQueryClassClass; using EventLogInput = COMEventLogInputContextClassClass; using CSVOutput = COMCSVOutputContextClassClass; using XMLOutput = COMXMLOutputContextClassClass; class Program { static void Main(string[] args) { try { // Instantiate the LogQuery object LogQuery oLogQuery = new LogQuery(); // Instantiate the Event Log Input Format object EventLogInput eventInputFormat = new EventLogInput(); // When set to "FW", events are retrieved from the oldest to the // newest. When set to "BW", events are retrieved from the newest // to the oldest. eventInputFormat.direction = "FW"; // Event text messages often span multiple lines. When this parameter // is set to "ON", the EVT input format preserves readability of the // messages by removing carriage-return, line-feed, and multiple space // characters from the message text. // When this parameter is set to "OFF", the EVT input format returns // the original message text with no intervening post-processing. eventInputFormat.formatMessage = true; eventInputFormat.binaryFormat = "ASC"; eventInputFormat.stringsSep = ","; CSVOutput csvOutputFormat = new CSVOutput(); // ON: always write the header; // OFF: never write the header; // AUTO: write the header only when not appending to an existing file. csvOutputFormat.headers = "ON"; // Setting this parameter to "ON" causes the CSV output format to write // a tab character after each comma field separator, in order to // improve readability of the CSV output. Note that using tabs between // field values might generate output that is not compatible with // certain spreadsheet applications. csvOutputFormat.tabs = false; // ON: always enclose field values within double-quote characters; // OFF: never enclose field values within double-quote characters; // AUTO: enclose within double-quote characters only those field // values that contain comma (,) characters. csvOutputFormat.oDQuotes = "AUTO"; // This parameter specifies the date and/or time format to use when // formatting values of the TIMESTAMP data type. csvOutputFormat.oTsFormat = "yyyy-MM-dd"; // 0 is the system codepage, -1 is UNICODE. csvOutputFormat.oCodepage = -1; // 0: existing files are appended with the output; // 1: existing files are overwritten with the output; // 2: existing files are left intact, discarding the output. csvOutputFormat.fileMode = 1; /* EventLog STRING Name of the Event Log or Event Log backup file RecordNumber INTEGER Index of this event TimeGenerated TIMESTAMP Event generated date/time (local time) TimeWritten TIMESTAMP Event logged date/time (local time) EventID INTEGER The ID of the event EventType INTEGER The numeric type of the event EventTypeName STRING The descriptive type of the event EventCategory INTEGER The numeric category of the event EventCategoryName STRING The descriptive category of the event SourceName STRING The source that generated the event Strings STRING The textual data ComputerName STRING The name of the computer SID STRING The Security Identifier associated with the event Message STRING The full event message Data STRING The binary data associated with the event */ string query = @"SELECT TOP 10 EventLog, RecordNumber, Message INTO " // Enclose path in single ticks to handle spaces. query += "'" + FullPathToCsv + "' FROM "; // Name of application Log, System, Security, Application, CustomLogName query += "System"; oLogQuery.ExecuteBatch(query, eventInputFormat, csvOutputFormat); } catch (System.Runtime.InteropServices.COMException ex) { Console.WriteLine("Unexpected error: " + ex.Message); } } } } 

Answer 3

This Powershell feature is the most efficient I could find. Not C # code, but I thought it might be useful. It accepts a file name (evtx) or a variable array of file names in Powershell as follows:

[array] $ filelist = "File1", "File2", "File3"

 Function Convert-Logs3 { [cmdletbinding()] Param( $filelist=$NULL ) $filelist | foreach-object { Get-WinEvent -Path "$PSItem"| Select RecordID,ID,TimeCreated, Message | export-csv - ``notypeinformation -path $(write "$PSItem.csv"); [System.gc]::collect(); }} 

Answer 4

If you need a tool that converts EVTX to CSV, you can directly use the LogParser tool:

 C:\> logparser "SELECT TimeGenerated, SourceName, EventCategoryName, EventId, Message INTO C:\eventlog.csv FROM C:\eventlog.evtx" -i:EVT 

I was able to use this to convert a 3 GB EVTX file to CSV in about 10 minutes.