Windows – Event Viewer Parsing Through Log Parser Studio

Background

Need to parse MS Windows Event Logs.

One of the ways to do so is to use Log Parser Studio.

 

Event Viewer

Let us save the events unto the File System.

Outline

  1. Launch Event Viewer
  2. Select the Logs you want ( Application / System / Security )
  3. Right click on the Logs and from the drop down menu, choose “Save All Events As …
  4. Choose Folder And Filename
  5. The file is saved with an extension of “Event Files (*.evtx )

 

Images

Launch Save Event As

Choose Filename

 

Log Parser Studio

Outline

  1. Launch Log Parser Studio
  2. Choose Log Type: EVTLOG
  3. Enter Query
  4. Execute Query

 

Choose Log Type : EVTLOG

Sample Queries


/*  Find top 1000 warnings and errors in the Application Log 
    Levels: 1=Error, 2=Warning                                
*/
SELECT TOP 1000 
             TimeGenerated
           , ComputerName
           , EventCategoryName
           , EventTypeName
           , EventID
           , SourceName
           , Message
FROM 'C:\Temp\04_WindowsLogs_Applications_20170518_0403PM.evtx'
WHERE ( EventType = 1 OR EventType = 2 )
AND   (
               (SourceName like 'ASP%' )
            or (SourceName = '.NET Runtime' )
            or (SourceName = 'Application Error' )
      )
ORDER BY TimeGenerated DESC


Click Execute Button

Click on the Execute Button – The Read icon with the exclamation mark!

 

Sample Output

 

Export

Outline

  1. In Log Parser Studio, use menu File \ Export \ Output as .CSV
  2. In the “Choose Location to save CSV File” window, please specify folder and file name

 

Images

File \ Export \ “Output as .CSV”

 

Choose Location to save CSV File

Excel File

 

VSS – Error – “Volume Shadow Copy Service error: Unexpected error DeviceIoControl(\\?\fdc#generic_floppy_drive”

Background

Reviewing errors on a couple of our servers and consistently seeing errors sourced to VSS.

BTW, VSS is a Microsoft Application and the term VSS stands for Volume Shadow Copy.

Error

Error Image

unexpectederror-deviceiocontrol-genericfloppydrive-20170118-0636pm-brushedup

Error Message



Volume Shadow Copy Service error: Unexpected error DeviceIoControl(\\?\fdc#generic_floppy_drive#6&2cb9d9b7&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} - 0000000000000474,0x00560000,0000000000000000,0,0000003E699986F0,4096,[0]).  hr = 0x80070001, Incorrect function.
. 

Operation:
   Exposing Recovered Volumes
   Locating shadow-copy LUNs
   PostSnapshot Event
   Executing Asynchronous Operation

Context:
   Device: \\?\fdc#generic_floppy_drive#6&2cb9d9b7&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
   Examining Detected Volume: Existing - \\?\fdc#generic_floppy_drive#6&2cb9d9b7&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
   Execution Context: Provider
   Provider Name: VMware Snapshot Provider
   Provider Version: 1.0.0
   Provider ID: {564d7761-7265-2056-5353-2050726f7669}
   Current State: DoSnapshotSet


Error Explanation

The Event Source is VSS.  And, the Event ID is 12289.

And, the event description reads  “Volume Shadow Copy Service error: Unexpected error DeviceIoControl(\?\fdc#generic_floppy_drive …  hr = 0x80070001, Incorrect function“.

Later on the Device Id is identified again within the Context sub-region.  And, the Device ID is 53f5630d-b6bf-11d0-94f2-00a0c91efb8b.

 

Remediation

NetApp Community

dailyFresh

Link

Did you, by any change, create a VM with a floppy drive, installed Windows and then one day removed the floppy drive from the VM?

In that case disable the floppy drive in the Device Manager of Windows and see if the error goes away.

 

Steps

  1. Launch Control Panel \ Device Manager
  2. Select Floppy disk drives \ Floppy disk drive
    • Right click on your selection
    • From the drop-down menu, please select disable
 Device Manager – Original

devicemanager-floppydiskdrive-20170118-0641pm

 

 

 Device Manager – Disabling the device ….

disablefloppydiskdrive

 

 Device Manager – Disabled Device

devicemanager-floppydiskdrive-20170118-0642pm

 

Knowledge Based

Here is some of the KB available on the Net.

 

Device Id

Removable Drives

smallvoid.com

Link

From smallvoid.com here are the registry keys for the various types of removable storages.

Device Type Registry Key
 CD and DVD Drives  {53f56308-b6bf-11d0-94f2-00a0c91efb8b}
 Floppy Drives  {53f56311-b6bf-11d0-94f2-00a0c91efb8b}
 Removable Disks  {53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
 Tape Drives  {53f5630b-b6bf-11d0-94f2-00a0c91efb8b}

 

 

Error

0x80070001

Error 0x80070001 often means that one is trying to access a device that does not exist.

Please refer to the following KB articles

  1. Windows backup or restore errors 0x80070001, 0x81000037, or 0x80070003
    Link

Giving Credit

Though DailyFresh will like to keep an Air of Anonymity, he still gets credit.

 

Technical : Microsoft – Event Log / Event Viewer – Query via PowerShell

Technical : Microsoft – Event Log / Event Viewer – Query via PowerShell

Introduction

After my fiasco of not paying attention to my Event Log, I need a quick way to aggregate Event Log entries and here is what I came up with through curating Google web postings.

Code



# PowerShell example which groups event then sorts in descending order.
Clear-Host

$logName = "System"

#get date
$dateCurrent = Get-Date

#For the Week
$NDays = -7
$dateNDaysAgo = $dateCurrent.AddDays($NDays)

Write-Host "Log Entries since $dateNDaysAgo"

Get-WinEvent -Logname $logName  | `
where-object { $_.timecreated -gt $date  -and $_.levelDisplayName -in "Critical", "error", "warning" } | `
Group-Object ProviderName, levelDisplayName, ID | `
Sort-Object Count -descending | `
Format-Table Count, Name -auto

Output:

EventLogAggregator

Conclusion

And, yes I have too much time on my hands, and not enough brains; as I need Splunk, Nagios, or System Center.

Addendum

Addendum – 2014.01.20

Tried the code above on an MS Windows Vista Machine, but unfortunately it failed.

The original code was developed and targeted an MS Windows 2012 box.

The error message we got on the Vista box read:


You must provide a value expression on the right-hand side of the '-' operator.
At C:\temp\eventvwr.ps1:16 char:68
+ where-object { $_.timecreated -gt $date  -and $_.levelDisplayName - <<<< in "
Critical", "error", "warning" } | `
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : ExpectedValueExpression

To Correct:



# PowerShell example which groups event then sorts in descending order.
Clear-Host

$logName = "System"

#get date
$dateCurrent = Get-Date

#For the Week
$NDays = -7
$dateNDaysAgo = $dateCurrent.AddDays($NDays)

$logLevel = @("Critical", "Warning", "Error")
$logLevelCritical = "Critical"
$logLevelWarning = "Warning"
$logLevelError = "Error"

Write-Host "Log Entries since $dateNDaysAgo"

Get-WinEvent -Logname $logName  | `
where-object {   ($_.timecreated -gt $date)  `
                 -and ( `
                       ($_.levelDisplayName -eq $logLevelCritical)  `
                   -or ($_.levelDisplayName -eq $logLevelWarning)   `
                   -or ($_.levelDisplayName -eq $logLevelError)     `
                      )  } | `
Group-Object ProviderName, levelDisplayName, ID | `
Sort-Object Count -descending | `
Format-Table Count, Name -auto

References

Event Log

WMI

Mac OS/X – Reading Microsoft Windows Event Log file (*.evtx) files

Prelude

As always, it is one inter-operability problem or another.

I need to send Windows Event Viewer Log files (*.evtx) to a colleague whose primary work computer is a Mac OSX.

 

Options

So what to do, tried using the App Store.

App Store - evtx

But, got no help.

Next goggled for help.

Found a gem in:

Cross-platform Windows Event Log viewer
http://jrs-s.net/2011/03/11/cross-platform-windows-event-log-viewer/

which led me to :

Windows Event Log Viewer (evtx_view)
http://www.tzworks.net/prototype_page.php?proto_id=4

tried to install the version for OSX (evtx_view.v.0.69.osx.tar.gz), but the system barked at me, that I needed X11 server and client libraries for OS X Mountain Lion.

Which in turn led me to XQuartz project: http://xquartz.macosforge.org. You should use XQuartz version 2.7.2 or later.

So please go ahead to http://xquartz.macosforge.org/landing/ and download XQuartz-2.7.4.dmg.

X Quartz

Thanks goodness that the version# is part of the dmg file’s name.  And, that version# is 2.7.4.  We needed at minimum a 2.7.2 and so this particular version should be sufficient.

Install XQuartz-2.7.4.dmg

The install base is quite big; about 200 MB.

XQuartz 2.7.4 Installer

So this installs several utilities, including:

  • An XWindows sub-system (that allows Unix type applications to be used on a Mac)

When we tried running the App (evtx_view):


./evtx_view

We received an error message stating:


FXApp::openDisplay: unable to open display :0.0

So what to does that error mean. Goggled and shouted for help and was able to determine that Xwindows needed to be installed and running.

To initiate an X-Windows Session, the best help I found are:

Installing FXRuby on OS X (Matthew Bass)
http://www.matthewbass.com/2008/06/02/installing-fxruby-on-os-x/

You should see an error message that looks something like this:

FXRbApp::openDisplay: unable to open display :0.0
It means your X11 terminal isn’t running. You can find it in /Applications/Utilities. Double click to launch. If you roll with Quicksilver, you should be able to type in X11 and launch it that way. Once launched, run the Ruby script again and you should see a tiny window with the title “Hello World.”

But, since X Windows support on Mac is now an Open Source project, you want to look for /Applications/Utilities/XQuartz

XQuartz

Once XQuartz is running, please go back and run evtx_view


./evtx_view

 

And, you should now see a running XApp App.

EventLog viewer

 

And, yes we are able to read MS Windows Log Files on Mac OS/X via this free rool evtx_view.  But, I am a bit put-back that the visually it is a bit lacking.

But, that only means that the data format is XML or at least published and well understood and that the display just needs to be worked-on.

References: