How do you read an archived eventlog file?

Question

Are there any libraries or resources available for parsing/reading an archived eventlogs?

Answer 1

Which IIS version do you use ? If you use IIS 6, You can use Microsoft Log Parser to see it. Download from IIS 6 Resource Kit

Answer 2

There is this article Parsing event log(*.evt) file. Then there is the Microsoft Event Log file format documentation (evt used on xp win 2003). So far the only information I can find for the new format is a pdf from some forensic conference. And how to convert evt to evtx

Answer 3

If the file is .evt, you can just run eventvwr, click Action->Open Log File and select the archived file and the file type.

For programmatic access, there is a .NET class System.Diagnostics.EventLog which would have everything you need.