玩轉Vista/Windows7下老格式事件日志分析

【注意，本文不適合初級電腦用戶】

如果有一個，一個朋友對你說他的電腦出現了問題，可能，你需要去分析它的系統的事件日志。畢竟，在Windows系統裡面，系統事件日志裡面記錄了太多的信息，應用程序的使用、崩潰等記錄，Windows系統的各種事件記錄等等。然而，當你的朋友把他的Windows目錄下的日志發過來，你想進行查看分析的時候，卻發現，提示事件日志崩潰！

這是怎麼回事呢？

原因很簡單，Vista之前事件日志是.evt文件，Vista及之後是.evtx文件！

我們可以用微軟提供的Log Parser 2.2（點擊進入微軟官方頁面），它能在相應的系統上解析各自支持的格式，解析命令為：

logparser -i:EVT "SELECT * INTO a.csv FROM b.evt"

但如果在Vista、Windows Server 2008、Windows7及之後系統上解析.evt格式日志可能會提示事件日志崩潰，這時需要將.evt格式轉換為.evtx格式，幸運的是Vista及之後的系統提供了Wevtutil－Windows Events Command Line Utility這個工具！

運行命令：wevtutil epl application.evt application.evtx /lf:true 就能轉化。

wevtutil 在系統裡面的提示都是英文，：

Windows Events Command Line Utility.

Enables you to retrieve information about event logs and Publishers, install
and uninstall event manifests, run queries, and export, archive, and clear logs.

Usage:

You can use either the short (for example, ep /uni) or long (for example,
enum-publishers /unicode) version of the command and option names. Commands,
options and option values are not case-sensitive.

Variables are noted in all upper-case.

wevtutil COMMAND [ARGUMENT [ARGUMENT] ...] [/OPTION:VALUE [/OPTION:VALUE] ...]

Commands:

el | enum-logs          List log names.
gl | get-log            Get log configuration information.
sl | set-log            Modify configuration of a log.
ep | enum-publishers    List event publishers.
gp | get-publisher      Get publisher configuration information.
im | install-manifest   Install event publishers and logs from manifest.
um | uninstall-manifest Uninstall event publishers and logs from manifest.
qe | query-events       Query events from a log or log file.
gli | get-log-info      Get log status information.
epl | export-log        Export a log.
al | archive-log        Archive an exported log.
cl | clear-log          Clear a log.

Common options:

/{r | remote}:VALUE
If specified, run the command on a remote computer. VALUE is the remote computer
name. Options /im and /um do not support remote operations.

/{u | username}:VALUE
Specify a different user to log on to the remote computer. VALUE is a user name
in the form domain\user or user. Only applicable when option /r is specified.

/{p | password}:VALUE
Password for the specified user. If not specified, or if VALUE is "*", the user
will be prompted to enter a password. Only applicable when the /u option is
specified.

/{a | authentication}:[Default|Negotiate|Kerberos|NTLM]
Authentication type for connecting to remote computer. The default is Negotiate.

/{uni | unicode}:[true|false]
Display output in Unicode. If true, then output is in Unicode.

To learn more about a specific command, type the following:

wevtutil COMMAND /?

關鍵詞：事件  分析  格式  日志