search

EricZimmerman / evtx

C# based evtx parser with lots of extras
MIT License
282 stars 59 forks source link

Evtxecmd #233

Closed Net4u13 closed 5 months ago

Net4u13 commented 9 months ago

When processing Windows event logs with evtxecmd I frequently see a notice that time just went backwards, but when reviewing the event logs there is not a gap in logs observed. An example provided below. Can you help to explain what this is indicating? 

Chunk count: 15,625, Iterating records...
Record #: 172349710 (timestamp: 2024-01-16 13:13:01.3026785): Warning! Time just went backwards! Last seen time before change: 2024-02-16 21:22:16.6101064

Also frequently observe a message stating that a value is not found and is replaced with an empty string. An example provided below. Can you help to explain what this is indicating?

Record # 75146 (Event Record Id: 75146): In map for event 1150, Property /Event/EventData/Data[@Name="Signature version"] not found! Replacing with empty string

EricZimmerman commented 9 months ago

It's just a warning as the records get processed is all. It's based on the order in the file itself vs how things get displayed. It generally can be ignored

The value not found is also informational and just means the key in the map isn't there, so it's going to use an empty string vs null.

Hth