---
id: python-evtx
version: "0.8.1"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# python-evtx — Pure Python parser for Windows event log files (.evtx).

License: permissive · Maintenance: active · Downloads: 163.5K/mo

## What it is and what it does

python-evtx is a pure Python parser that reads Windows Event Log files in the .evtx format introduced with Windows Vista and later. It decodes the proprietary binary XML structure into accessible Python objects, allowing you to extract event records, templates, and metadata programmatically. The package works across Windows, macOS, and Linux, making it useful for analyzing Windows logs from non-Windows systems.

The parser exposes file headers, chunk structures, record templates, and individual event entries through a straightforward API. It includes command-line tools for dumping logs as XML or JSON, verifying chunk checksums, and inspecting templates. The implementation is based on documented format specifications and earlier Perl and C++ parsers, ensuring compatibility with standard .evtx files.

Use it for:

- Analyze Windows Security event logs from a Linux or macOS forensic workstation
- Extract and transform event log data into JSON for integration with log aggregation systems
- Verify the integrity of event log chunks by checking embedded checksums
- Build custom event log analysis tools that parse .evtx files programmatically
- Review event templates and their structure within a log file for debugging or auditing

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses Windows Event Log files (.evtx) into structured XML or JSON, providing programmatic access to event records, templates, and metadata across Windows, macOS, and Linux.

Yes. The package is actively maintained, has no known vulnerabilities, installs with minimal friction, and uses a permissive Apache-2.0 license. It fills a specific need for cross-platform .evtx parsing with a straightforward API. Install it if you need to read Windows event logs outside Windows or integrate event log data into analysis pipelines.

## Install

pip install python-evtx
uv add python-evtx
poetry add python-evtx

## Installing python-evtx

Before you install: Low friction: pure Python wheel with a single runtime dependency (hexdump). Actively maintained with recent commits and stable status since 2013.

License in practice: Apache-2.0 permissive license allows free use, modification, and redistribution in personal and professional contexts without significant restrictions.

Quickstart:

pip install python-evtx

from Evtx.Evtx import Evtx

with Evtx('Security.evtx') as log:
    for record in log.records:
        print(record.xml())

Verify before relying:

- Whether hexdump is available on all target platforms or if it must be installed separately
- Performance characteristics when parsing large event log files (hundreds of megabytes)

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 163.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

windows event log parser, evtx file reader, parse .evtx files, windows event log analysis, binary xml event log, cross-platform evtx parser, event log to xml conversion, forensics, log-analysis, windows-events

[View on SkillFed](https://skillfed.io/packages/python-evtx) · [View on PyPI](https://pypi.org/project/python-evtx/)