grokevt-builddb - Online in the Cloud

PROGRAM:

NAME

grokevt-builddb - Builds a database tree based on a single windows system for the purpose
of event log conversion.

SYNOPSIS

grokevt-builddb [ -c CSID ] config-profile output-dir .SH DESCRIPTION grokevt-builddb uses
grokevt-ripdll(1) and reglookup(1) along with information found in configuration files to
extract all necessary information from a windows installation for the conversion of event
log files. The registry is read to determine the locations of critical DLLs and the event
log files themselves. This, and other information out of the registry is stored in a
directory structure which acts as a kind of flat-file database. This database can then be
used by grokevt-parselog(1) to generate human-readable output.

The key to successfully running this utility is proper configuration. Please see
grokevt(7) for information on what needs to be configured.

ARGUMENTS

config-profile
This is the name of the configuration profiles stored in the global configuration
directory under the directory 'systems'. See grokevt(7) for more details on how to
properly configure a system profile.

output-dir
The path to the location of the output database. If anything already exists in
this directory, it may be overwritten or deleted.

OPTIONS

-c CSID
This option allows one to explicitly set which ControlSet in the registry is used
to extract event log message mappings. If specified, this item must be a positive
decimal integer. If unspecified, grokevt-builddb will attempt to determine the
best ControlSet by looking at the most recent CurrentControlSet, stored in the
system registry under the path '/Select/Current'. Most users should ignore this
option unless there is a specific reason why the last CurrentControlSet should not
be used.

EXAMPLES

To generate a database at '~/win2k.grokevt' based on the system configuration profile
'win2k':

grokevt-builddb win2k ~/win2k.grokevt

To repeat the last command, instead using registry information explicitly from
/ControlSet002:

grokevt-builddb -c 2 win2k ~/win2k.grokevt

Use grokevt-builddb online using onworks.net services