Windows in the Enterprise

Converting Event Log Files

Working with multiple versions of Windows client and server operating systems can occasional cause some frustration. For instance, if you have both Windows Server 2008 and Windows Server 2003 running on your servers, you might get tripped up because of the different formats these two versions of Windows use for their event logs. On the one hand, you've got the "classic" EVT log file format of Windows Server 2003 and earlier. Then you've got the newer, XML-based EVTX lot file format of Windows Server 2008 and Windows Vista, which is easier to search than the legacy format.

So the question arises, how can you convert older EVT logs into the newer EVTX format? Here are three ways you can do this.

First, you can use the new WEVTUTIL command in Windows Server 2008 as follows:

wevtutil epl application.evt application.evtx /lf:true

Second, you can copy the below reg script into Notepad, save it using the .reg extension, and merge it into your registry. When you do this and restart your system, you'll be able to right-click on an .evt file and select a "Convert to evtx" option from the shortcut menu.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\SystemFileAssociations\.evt]

[HKEY_CLASSES_ROOT\SystemFileAssociations\.evt\shell]

[HKEY_CLASSES_ROOT\SystemFileAssociations\.evt\shell\ConvertToEvtx]

@="Convert to evt&x"

[HKEY_CLASSES_ROOT\SystemFileAssociations\.evt\shell\ConvertToEvtx\command]

@="\"wevtutil.exe\" epl \"%1\" \"%1x\" /lf:true"

And third, you can use Windows PowerShell as follows to recurse a folder and convert multiple evt files as a single batch:

dir *.evt -recurse | foreach-object {wevtutil epl $_.FullName ($_.FullName + "x") /lf:true}

What tricks to you use for managing event logs? Email me and I'll share them with our readers.