Security Compliance

Import archived Windows event logs into SEM

Learn how to import Windows event logs into Security Event Manager (SEM). You may want to complete this process on an unused/new system or blank VM as importing can affect the Security log.

First published date

10/9/2018 5:49 PM

Last published date

10/9/2018 5:50 PM

Product section

Security Event Manager

Resolution

Note:

It is recommended that you perform the following steps on an unused system or a blank VM as these could affect the Security log on the system where they are taken from.

To import archived Windows event logs:

  1. On a blank system or VM, set the Windows Event Log service to start manually.
    1. Click Start, Open CMD, and then run services.msc.
    2. From the Services pane, scroll to and right-click Windows Event Log > Properties.
    3. In the Startup type drop down box, select Manual, and then click OK.
  2. Reboot the system to allow your changes to be applied.
  3. Stop the SEM Agent.
    1. Click Start, open CMD, and then run services.msc.
    2. From the Services pane, scroll to and right-click SolarWinds Security Event Manager Agent > Stop.
  4. Stop the Windows Event Log service
    1. Click Start, open CMD, and then run services.msc.
    2. From the Services pane, scroll to and right-click Windows Event Log > Stop.
  5. Copy the .evtx file and paste it to C:\Windows\System32\winevt\Logs.
  6. Rename the .evtx file to 

    Note: Rename first any existing 

    1. In Windows Explorer, go to C:\Windows\System32\winevt\Logs.
    2. Select the archived  file, and rename it to Security.evtx.
  7. Adjust readerState.xml.

    Note: 0 means to start at the beginning of the Event log.

    1. Go to C:\Windows\SysWOW64\ContegoSPOP\tools.
    2. Change readerState.xml to logStartPoint=”0”.
    3. Change description to .
  8. Restart the Windows Event Log service.
    1. Click Start, open CMD, and then run services.msc.
    2. From the Services pane, scroll to and right-click Windows Event Log > Start the Service.
  9. Restart the LEM Agent.
    1. Click Start, open CMD, and then run services.msc.
    2. From the Services pane, scroll to and right-click SolarWinds Security Event Manager Agent > Start the Service.

The SEM Agent, if it has a connector that can read the Windows Security log, should be able to parse through the copied Event logs. These parsed logs have the DetectionTime in SEM matching the time the logs were initially generated.