omerbenamram / evtx

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format
Apache License 2.0
625 stars 61 forks source link

Fix the format of datetime #213

Closed abaghinyan closed 1 year ago

abaghinyan commented 2 years ago

Description

The output of the datetime format is not deterministic.
When milliseconds are equal to zero, it cuts the date and change from "%Y-%m-%dT%H:%M:%S%.6fZ" to "%Y-%m-%dT%H:%M:%SZ".

Root cause

The output format of the Datetime type is not set.

Solution

Set the format to "%Y-%m-%dT%H:%M:%S%.6fZ" for all Datetime types.

Test

omerbenamram commented 1 year ago

Thanks!