0

In eventvwr the OS event log was set to automatic archive when full:

enter image description here

This creates files such as "C:\Windows\System32\Winevt\Logs\Archive-Security-2016-10-07-09-29-41-743.evtx" when the limit for ..Winevt\Logs\Security.evtx is reached. The events archived as such do not show up in eventvwr "the usual way" under:

enter image description here

How can they be made to show up the usual way?

I've increased the log size limit to accomodate all the archives. Next, how can I merge the event logs ..Winevt\Logs\Archive-Security-***** back to ..Winevt\Logs\Security.evtx?


• version Win 8.1 Core if relevant.

1

This won't put them back into the system logs, but why not just use an .evtx viewer like Nirsoft FullEventLogView v1.00 to inspect the separate files. That's easier then trying to force your square pegs into round holes (assuming they still may not fit).

FullEventLogView is a simple tool for Windows 10/8/7/Vista that displays in a table the details of all events from the event logs of Windows, including the event description. It allows you to view the events of your local computer, events of a remote computer on your network, and events stored in .evtx files. It also allows you to export the events list to text/csv/tab-delimited/html/xml file from the GUI and from command-line.

Selecting the source:

enter image description here

You can do all kinds of filtering in the Advanced Options:

enter image description here

  • Yea Nirsoft is a good alternative view tool, but I'm trying to merge the logs on the system so that they could be recognized by programs as Live Logs instead of archived logs. (They shouldn't have been archived in the first place.) – Pacerier Oct 14 '16 at 11:55
1

Here is an untested way you can try (including my assumptions):

Your current event logs are in c:\Windows\System32\winevt\Logs\.

Copy those Archive-Security-20xx-xx-xx-xx-xx-xx-xxx.evtx and the current Security.evtx to a separate folder.

Download and install Event Log Explorer (Free for personal use - You did not say if you were willing to pay for a solution and/or if it is for personal use). Its documentation talks only about .evt files but since it's also for Win7+ it will handle .evtx as well. The program features say:

Event Log Explorer allows you not only to read events from different sources, but to consolidate them in one event view. You can review such a view as a solid log. You can even save this consolidated event log as an EVT file.

Now read all those copied files into the program and write them all back out to c:\Windows\System32\winevt\Logs\Security.evtx. I am assuming you can overwrite that file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.