软件包：grokevt（0.5.0-5）

scripts for reading Microsoft Windows event log files

GrokEVT is a collection of scripts built for reading Microsoft Windows NT/2000/XP/2003 event log files.

Currently the scripts work together on one or more mounted Microsoft Windows partitions to extract all information needed (registry entries, message templates, and log files) to convert the logs to a human-readable format.

This program is useful in forensics investigations.

标签: 系统管理: 日志, 用户接口: 命令行, 角色: role::program, security::forensics, 安全性: 日志分析, Purpose: use::converting, works-with::logfile

本页其他语言版本如下（如何设置默认文档语言）：