python-evtx
Pure Python parser for Windows event log files (.evtx).
Decision gist · record as of 2026-08-14
Yes. The package is actively maintained, has no known vulnerabilities, installs with minimal friction, and uses a permissive Apache-2.0 license. It fills a specific need for cross-platform .evtx parsing with a straightforward API. Install it if you need to read Windows event logs outside Windows or integrate event log data into analysis pipelines.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low friction: pure Python wheel with a single runtime dependency (hexdump).
- Actively maintained with recent commits and stable status since 2013.
License · maintenance · safety
Apache-2.0 (permissive) — Apache-2.0 permissive license allows free use, modification, and redistribution in personal and professional contexts without significant restrictions.
last release 2025-05-02 (469 days) · last repo commit 2026-03-19 · 777 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 163,514 downloads/mo, #10,570 on PyPI
Alternatives
Verify before relying
pip install python-evtx
from Evtx.Evtx import Evtx
with Evtx('Security.evtx') as log:
for record in log.records:
print(record.xml())- Whether hexdump is available on all target platforms or if it must be installed separately
- Performance characteristics when parsing large event log files (hundreds of megabytes)
What it is and what it does
python-evtx is a pure Python parser that reads Windows Event Log files in the .evtx format introduced with Windows Vista and later. It decodes the proprietary binary XML structure into accessible Python objects, allowing you to extract event records, templates, and metadata programmatically. The package works across Windows, macOS, and Linux, making it useful for analyzing Windows logs from non-Windows systems.
The parser exposes file headers, chunk structures, record templates, and individual event entries through a straightforward API. It includes command-line tools for dumping logs as XML or JSON, verifying chunk checksums, and inspecting templates. The implementation is based on documented format specifications and earlier Perl and C++ parsers, ensuring compatibility with standard .evtx files.
Use it for
- Analyze Windows Security event logs from a Linux or macOS forensic workstation
- Extract and transform event log data into JSON for integration with log aggregation systems
- Verify the integrity of event log chunks by checking embedded checksums
- Build custom event log analysis tools that parse .evtx files programmatically
- Review event templates and their structure within a log file for debugging or auditing
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
The package is actively maintained, has no known vulnerabilities, installs with minimal friction, and uses a permissive Apache-2.0 license. It fills a specific need for cross-platform .evtx parsing with a straightforward API. Install it if you need to read Windows event logs outside Windows or integrate event log data into analysis pipelines.
Install
python-evtx on PyPI
Before you install
Low friction: pure Python wheel with a single runtime dependency (hexdump). Actively maintained with recent commits and stable status since 2013.
License in practice
Apache-2.0 permissive license allows free use, modification, and redistribution in personal and professional contexts without significant restrictions.
Quickstart
pip install python-evtx
from Evtx.Evtx import Evtx
with Evtx('Security.evtx') as log:
for record in log.records:
print(record.xml())Verify before relying
- Whether hexdump is available on all target platforms or if it must be installed separately
- Performance characteristics when parsing large event log files (hundreds of megabytes)
Package facts
| License | Apache-2.0 permissive |
| Python support | Supports the current Python release >=3.9 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagehexdump |
| Maintenance | Actively maintained 469 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 163,514 / month, #10,570 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersIntended Audience :: Information TechnologyOperating System :: OS IndependentProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.9Topic :: SecurityTopic :: Software Development :: Libraries :: Python ModulesTopic :: System :: Logging |
Evidence: python_evtx-0.8.1-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “windows event log parser”
- python-evtxParses Windows Event Log files (.evtx) into structured XML or JSON,…
- winevtWinevt lets you query and subscribe to Windows Event Logs directly…
- tbparseParses TensorBoard event log files and loads them as pandas…
Give your agent the search over MCP, or paste the wish link into any chat.
More Python Modules packages
Converts domain names between Unicode and ASCII-compatible encoding (Punycode) according to IDNA 2008 and Unicode Technical Standard 46, with security validation and broader script coverage than the standard library.
Install it if you work with internationalized domain names, need to validate domains, or use HTTP clients that depend on it transitively.
Setuptools is a Python build backend and package management tool that handles building, distributing, and installing Python packages, including support for C/C++ extension modules.
PyYAML parses and emits YAML 1.1 data format, enabling serialization and deserialization of configuration files and Python objects to and from human-readable YAML text.
Pydantic validates Python data structures against type hints, coercing and checking input at runtime to ensure it matches a declared schema.
Provides reusable metadata objects for use with PEP-593 `typing.Annotated` to express common constraints like bounds, collection sizes, and predicates on types.
Install it if you use or build libraries that need to express type constraints in a standardized, inspectable way—or if you want to annotate your own types with…
Provides runtime tools to inspect and introspect Python type annotations, enabling programmatic examination of type hints at execution time.
See also winevt · JSON-log-formatter · python-hwpx · dicttoxml · datadog-logger · pycomposefile · docx · docx2python · xmltodict · data-to-xml