Re: NT log file format?

["Ryan Russell" <Ryan.Russell () sybase com>]

> Anyone got any pointers to C code for dissecting NT log
> file formats under UNIX? Or is that pretty much an insane/inane
> idea?

The hard part about NT log files is that the event ID is stored
as a number, and that number is pulled out of files on the NT
box when it's viewed.  So for example, if you install an application
that logs to one of the NT logs, it will also install the files that are
used to look up event IDs in.

The end result is that if one views the logs elsewhere, one
doesn't always get a description of what the event is, because
those files aren't on the system where the logs are being viewed.
This makes in challenging to view logs on a different NT box,
let alone a unix box.

If you're looking a limited set of events, you could make your own
map by hand.

                         Ryan