poka.sh

 Docs

EVT

Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.

Windows NT Event Log.

At a glance
Original creator Microsoft
Purpose The classic Windows NT event log (System, Application, Security), used before Windows Vista replaced it with .evtx.
Extensions .evt
Poka parser poka-evt
Viewer poka-table-viewer
Depth tier Parser with a shared viewer (see Depth tiers)
Breadth tier B2 Broad (see Breadth tiers)

How much Poka reads

B2 Broad. The common content of the current and the common older versions is decoded. Some named features or versions are not, and are listed.

Confidence: high (the reviewer read the code and a test that proves the claim). Basis: Reviewed 2026-10-16: parsers/poka-evt/src/lib.rs, its unit tests and tests/samples.rs. The corpus holds one real wrapped System log (SysEvent.Evt, plaso test data), asserted for record order across the wrap, first-record time, type, ID, source, computer and strings, and for truncation safety. Covers classic NT/2000/XP/2003 .evt logs: header, circular buffer, padding and end marker, and per-record fields.

What Poka does not read

  • Only the first 1,000 records are listed (the total is counted and flagged)
  • The user SID is not decoded or shown
  • The binary data block of each event is not shown
  • The time written is not shown (only time generated)
  • Category is a number, not a name, and the high bits of the event ID (severity, facility) are dropped
  • Event message text is not resolved because it lives in the source DLL's message table (inherent to the log)
  • Closing record number and the header's retention and maximum size are not shown

Background

Microsoft documents the format: a fixed header (ELF_LOGFILE_HEADER), event records (EVENTLOGRECORD) and an end-of-file record, and says it is no longer used from Windows Vista on. The records sit in a circular buffer that can wrap, so the oldest record may come after the newest in the file. Poka follows the buffer from its start offset, reads records that straddle the wrap, and shows one row per event with its time, ID, type, source, computer and insertion strings.

Versions

Version Identifier Poka Note
Windows NT event log LfLe Read
Windows Vista and later event log Not read That is .evtx, a different format not claimed here.

Libraries

Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.

Sources