python-evtx

What it is and what it does

python-evtx is a pure Python parser that reads Windows Event Log files in the .evtx format introduced with Windows Vista and later. It decodes the proprietary binary XML structure into accessible Python objects, allowing you to extract event records, templates, and metadata programmatically. The package works across Windows, macOS, and Linux, making it useful for analyzing Windows logs from non-Windows systems.

The parser exposes file headers, chunk structures, record templates, and individual event entries through a straightforward API. It includes command-line tools for dumping logs as XML or JSON, verifying chunk checksums, and inspecting templates. The implementation is based on documented format specifications and earlier Perl and C++ parsers, ensuring compatibility with standard .evtx files.

Use it for:

• Analyze Windows Security event logs from a Linux or macOS forensic workstation
• Extract and transform event log data into JSON for integration with log aggregation systems
• Verify the integrity of event log chunks by checking embedded checksums
• Build custom event log analysis tools that parse .evtx files programmatically
• Review event templates and their structure within a log file for debugging or auditing

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses Windows Event Log files (.evtx) into structured XML or JSON, providing programmatic access to event records, templates, and metadata across Windows, macOS, and Linux.

Yes. The package is actively maintained, has no known vulnerabilities, installs with minimal friction, and uses a permissive Apache-2.0 license. It fills a specific need for cross-platform .evtx parsing with a straightforward API. Install it if you need to read Windows event logs outside Windows or integrate event log data into analysis pipelines.

Install

python-evtx on PyPI

pip install python-evtx

uv add python-evtx

poetry add python-evtx

Installing python-evtx

Before you install

Low friction: pure Python wheel with a single runtime dependency (hexdump). Actively maintained with recent commits and stable status since 2013.

License in practice

Apache-2.0 permissive license allows free use, modification, and redistribution in personal and professional contexts without significant restrictions.

Quickstart

pip install python-evtx

from Evtx.Evtx import Evtx

with Evtx('Security.evtx') as log:
    for record in log.records:
        print(record.xml())

Verify before relying

• Whether hexdump is available on all target platforms or if it must be installed separately
• Performance characteristics when parsing large event log files (hundreds of megabytes)

Package facts

Evidence: python_evtx-0.8.1-py3-none-any.whl

Tags

More Python Modules packages