Wednesday, May 22, 2013

.evt versus .evtx log files

"Classic" .evt log files do not necessarily convert to the new .evtx format.  This becomes an issue when you get sent a log from a Windows Server 2003 server, and need to examine it using the Event Viewer on your Windows 7 pc.  Sometimes you can use Event Viewer's "Save all events as" feature to convert the file to a .evtx file, but this does not always work.  Occasionally you get a "The data is invalid" error.  When this happens, the only way I know of to efficiently examine the log file is to copy it over to a Windows Server 2003 server, and look at it using the old Event Viewer.

No comments:

Post a Comment