dissect.eventlog#
A Dissect module implementing parsers for the Windows EVT, EVTX and WEVT log file formats.
Installation#
dissect.eventlog
is available on PyPI.
$ pip install dissect.eventlog
This module is also automatically installed if you install the dissect
package.
Usage#
This package is a library with no CLI tools, so you can only interact with it from Python. For example, to print all records in an
.evtx
or .evt
file:
from dissect.eventlog.evtx import Evtx
with open("/path/to/file.evtx", "rb") as fh:
logfile = Evtx(fh)
for record in logfile:
print(record)
with open("/path/to/file.evt", "rb") as fh:
logfile = Evt(fh)
for record in logfile:
print(record)
Reference#
For more details, please refer to the API documentation of dissect.eventlog
.