Event Log Dump Parsing

I am using dumpel.exe to dump several domain controllers' security
event logs 3 times per day. We generate numerous large .evt files due
to required corporate auditing mandates. Now I need to write a
vbscript that will allow me to parse multiple .evt files, looking for
any user activity for a specified user across several days, for
example. I have the need to put this into a fully automated script,
for various reasons, which as far as I can tell rules out eventcomb,
as it appears to require the GUI interface to run interactively. Does
anyone have any suggestion on how to parse these .evt files? I
haven't yet found any utilities other than eventcomb that allow me to
even search a flat .evt file. If you have suggestions, or think
dumpel or eventcomb may still work, please provide an example of the
syntax of these could work given my scenario. Thanks!

Wayne
Tue Aug 17 12:09:31 CDT 2004

jacksneed2000@yahoo.com (Jack) wrote in
news:1cbee35b.0408170701.7050790b@posting.google.com:

> I am using dumpel.exe to dump several domain controllers' security
> event logs 3 times per day. We generate numerous large .evt files due
> to required corporate auditing mandates. Now I need to write a
> vbscript that will allow me to parse multiple .evt files, looking for
> any user activity for a specified user across several days, for
> example. I have the need to put this into a fully automated script,
> for various reasons, which as far as I can tell rules out eventcomb,
> as it appears to require the GUI interface to run interactively. Does
> anyone have any suggestion on how to parse these .evt files? I
> haven't yet found any utilities other than eventcomb that allow me to
> even search a flat .evt file. If you have suggestions, or think
> dumpel or eventcomb may still work, please provide an example of the
> syntax of these could work given my scenario. Thanks!
>

Jack,

Search the Microsoft website for the 'logparser' utility. It gives you
SQL type query capabilities against a number of different file formats
including event logs and dumped event logs. It's pretty easy to use once
you get the syntax down and it includes a COM interface if I recall
correctly.

Hope that helps,

Wayne

--
Standard Disclaimer: I said it, they didn't, so blame me, not them!
Spam Avoidance: My reply address is invalid to confuse the spambots.
You can reach me at 'Wayne_Tilton at yahoo dot com'