logparser -i:evt -o:csv "select * into D:\1.csv from D:\Security.evtx where eventid=4624"
下表为提取的字段名与示例：两个表为1个表，上下顺序为从左往右，包括下面的MESSAGE部分。
EventLog
RecordNumber
TimeGenerated
TimeWritten
EventID
EventType
EventTypeName
EventCategory
D:\Security.evtx
2
2014/2/15 13:09:00
2014/2/15 13:09:00
4624
8
Success Audit event
12544
EventCategoryName
SourceName
Strings
ComputerName
SID
The name for category 12544 in Source "Microsoft-Windows-Security-Auditing" cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer
The specified account's password has expired. (535)
%%2310
Account currently disabled. (531)
%%2311
Account logon time restriction violation. (530)
%%2312
User not allowed to logon at this computer. (533)
%%2313
Unknown user name or bad password. (529)
5、导出文件
INTO语法导出必须使用LogParser，LPS需要用菜单选择导出。
logparser -i:evt -o:csv "select Extract_token(Strings,11,'|') into d:\11.csv from D:\Security-2008.evtx where eventid=4624"
6、只输出有主机名的记录
select Extract_token(Strings,11,'|'),* from D:\Security-2008.evtx where eventid=4624 and Extract_token(Strings,11,'|') not in (NULL;'';'-')
7、只显示登录类型3的数据
select * from D:\Security-2008.evtx where Extract_token(Strings,8,'|')='3'
8、只显示指定主机名的数据
主机名保持大写
select * from D:\Security-2008.evtx where eventid=4624 and Extract_token(Strings,11,'|')='NEW-666'
9、将日志整理成新的表
把strings中包含的需要的字段进行分割，使用as指定字段别名。
# EventID 4624
select EventLog,TimeGenerated,EventID,
Extract_token(Strings,8,'|') as LogonType,
Extract_token(Strings,5,'|') as UserName,
Extract_token(Strings,11,'|') as HostName,
Extract_token(Strings,18,'|') as SourceIP,
Extract_token(Strings,19,'|') as SourcePort
from D:\Security-2008.evtx where eventid=4624 and
Extract_token(Strings,11,'|') not in (NULL;'';'-') and
Extract_token(Strings,5,'|') <> 'ANONYMOUS LOGON'
# EventID 4625
select EventLog,TimeGenerated,EventID,
Extract_token(Strings,10,'|') as LogonType,
Extract_token(Strings,5,'|') as UserName,
Extract_token(Strings,13,'|') as HostName,
Extract_token(Strings,19,'|') as SourceIP,
Extract_token(Strings,20,'|') as SourcePort,
Extract_token(Strings,8,'|') as FailReason
from D:\Security.evtx where eventid=4625
10、根据IP，主机名，用户名等进行排序
使用Order by 语法进行排序
select EventLog,TimeGenerated,EventID,
Extract_token(Strings,8,'|') as LogonType,
Extract_token(Strings,5,'|') as UserName,
Extract_token(Strings,11,'|') as HostName,
Extract_token(Strings,18,'|') as SourceIP,
Extract_token(Strings,19,'|') as SourcePort
from D:\Security-2008.evtx where eventid=4624 and
Extract_token(Strings,11,'|') not in (NULL;'';'-') and
Extract_token(Strings,5,'|') <> 'ANONYMOUS LOGON'
Order by
SourceIP DESC
11、筛选登录失败最多的IP，主机名
筛选出EventID4625结果中每个IP出现的次数
select Extract_token(Strings,19,'|') as SourceIP,
Count(SourceIP) as CountIP
from D:\Security-2008.evtx where eventid=4625
group by SourceIP
order by
CountIP DESC
筛选出EventID4625结果中每个主机名出现的次数
select Extract_token(Strings,13,'|') as HostName,
Count(HostName) as CountHost
from D:\Security-2008.evtx where eventid=4625
group by HostName
order by CountHost DESC
logparser -i:evt -o:csv
"select
EventLog,TimeGenerated,EventID,Extract_token(Strings,10,'|') as
LogonType,Extract_token(Strings,5,'|') as
UserName,Extract_token(Strings,13,'|') as
HostName,Extract_token(Strings,19,'|') as
SourceIP,Extract_token(Strings,20,'|') as
SourcePort,Extract_token(Strings,8,'|') as
FailReason into D:\all.csv
from D:\Security.evtx where eventid=4625"
12、计算文件HASH
说个不太相关的，logparser也能计算文件hash。
logparser -i:FS "select path,hashmd5_file(path) from d:\22.csv"
wevtutil qe D:\Security-2008.evtx /lf /q:"*[System[(EventID=4624)] and EventData[(Data[@Name='TargetUserName']='laowang')]]" /c:1
同时指定用户名与来源IP地址
wevtutil qe D:\Security-2008.evtx /lf /q:"*[System[(EventID=4624)] and EventData[(Data[@Name='TargetUserName']='laowang') and (Data[@Name='IpAddress']='172.16.175.99')]]" /c:1
