NAME
grokevt-builddb - Builds a database tree based on a single windows
system for the purpose of event log conversion.
SYNOPSIS
grokevt-builddb [ -c CSID ] config-profile output-dir .SH DESCRIPTION
grokevt-builddb uses grokevt-ripdll(1) and reglookup(1) along with
information found in configuration files to extract all necessary
information from a windows installation for the conversion of event log
files. The registry is read to determine the locations of critical DLLs
and the event log files themselves. This, and other information out of
the registry is stored in a directory structure which acts as a kind of
flat-file database. This database can then be used by grokevt-
parselog(1) to generate human-readable output.
The key to successfully running this utility is proper configuration.
Please see grokevt(7) for information on what needs to be configured.
ARGUMENTS
config-profile
This is the name of the configuration profiles stored in the
global configuration directory under the directory ’systems’.
See grokevt(7) for more details on how to properly configure a
system profile.
output-dir
The path to the location of the output database. If anything
already exists in this directory, it may be overwritten or
deleted.
OPTIONS
-c CSID
This option allows one to explicitly set which ControlSet in the
registry is used to extract event log message mappings. If
specified, this item must be a positive decimal integer. If
unspecified, grokevt-builddb will attempt to determine the best
ControlSet by looking at the most recent CurrentControlSet,
stored in the system registry under the path ’/Select/Current’.
Most users should ignore this option unless there is a specific
reason why the last CurrentControlSet should not be used.
EXAMPLES
To generate a database at ’~/win2k.grokevt’ based on the system
configuration profile ’win2k’:
grokevt-builddb win2k ~/win2k.grokevt
To repeat the last command, instead using registry information
explicitly from /ControlSet002:
grokevt-builddb -c 2 win2k ~/win2k.grokevt
BUGS
Probably a few. This script has not been extensively tested with some
guest platforms.
The databases built with this script may not be portable to other
systems, depending on the database drivers installed and used in
Python.
CREDITS
Written by Timothy D. Morgan.
Copyright (C) 2005-2007 Timothy D. Morgan
LICENSE
Please see the file "LICENSE" included with this software distribution.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License version 2 for more details.
SEE ALSO
grokevt(7) grokevt-addlog(1) grokevt-dumpmsgs(1) grokevt-findlogs(1)
grokevt-parselog(1) grokevt-ripdll(1) reglookup(1)