Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

How can I export windows event logs with verbose messages


  • Please log in to reply
2 replies to this topic

#1
perlabsrat

perlabsrat

    Newbie

  • Member
  • 28 posts
  • Joined 28-November 07
  • OS:Windows 7 x64
  • Country: Country Flag
Hello,


I have been searching the web and cannot seem to find a good answer on this. I sort of understand the cause but need some help on the solution.
I use the following command to export windows system logs. I want/need them to be in evtx format for later use.

wevtutil epl system c:\SystemEvents.evtx

The goal is to send them to other people which will not be viewing them on the same server. This of course cause the full event text to not be part of the exported log and the user will see something like this:

The description for Event ID XXX from source Server Administrator cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
    If the event originated on another computer, the display information had to be saved with the event.
    The following information was included with the event:
I was reading this page: http://technet.micro...339(WS.10).aspx

and found this snip of info in it:

To troubleshoot events that were logged on a remote computer, you must export and archive the log with the display information. The display information for the saved events is stored in the LocaleMetaData folder and should be moved with the log information when the information is viewed on another computer.



I do not understand what location (or process) this statement is referring to. There is no LocaleMetaData folder anywhere on the server so I am assuming that I need to somehow create and export some additional data along with the evtx file for it to then re-merge back on the viewing system.
Am I on the right track here and could someone tell me how to fully export the event log this with will full verbose messages?

Thanks.


How to remove advertisement from MSFN

#2
Tripredacus

Tripredacus

    K-Mart-ian Legend

  • Super Moderator
  • 9,964 posts
  • Joined 28-April 06
  • OS:Server 2012
  • Country: Country Flag

Donator

When you use this:

wevtutil al <FileName.evtx> [/l:<LocaleString>]

to export... the location of where the .evtx folder ends up, there will be a LocaleMetaData folder created with the .MTA file inside.
MSFN RULES | GimageX HTA for PE 3-5 | lol probloms
tpxmsfn1_zps393339c1.jpg

#3
perlabsrat

perlabsrat

    Newbie

  • Member
  • 28 posts
  • Joined 28-November 07
  • OS:Windows 7 x64
  • Country: Country Flag
Using

wevtutil al <FileName.evtx>

worked for me. One thing I did not understand was the syntax of the [/l:<LocaleString>]
I tried using:

/l:409  /l:1033 and /l:en-us


Since it worked without the need to specify that switch I am ok now but i am courious what the syntax of this switch is supposed to be..




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users