williballenthin / python-evt

Pure Python parser for classic Windows Event Log files (.evt)
Apache License 2.0
48 stars 11 forks source link

Add computer name field to Record #1

Closed zrweger closed 9 years ago

zrweger commented 9 years ago

See https://msdn.microsoft.com/en-us/library/cc231412.aspx

The offset to the Computername is variable, pending where the SourceName terminates. I didn't want to recompute the offset just for the add_explicit_field call. I'm also a little more careful about checking that the terminator is actually word-aligned than the rest of the code, but alas.

williballenthin commented 9 years ago

another great addition, thanks!