python-evtx

library0.8.1pypypi✓ verified 82d ago

A pure Python parser for Windows event log files (.evtx). Version 0.8.1 supports Python >=3.9, provides XML and JSON dump functionality, and extracts event records from EVTX files. Maintenance is active with occasional releases.

data serialization database

pip install python-evtx

github ↗package ↗

INSTALL

IMPORT

SIG · PYTHON-EVTX

python-evtx

datapythonv0.8.1

Install

2.5s avg

Import

—

Disk

17MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.8.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 19.5MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 2.5s · import 0.000s · 20MB

17MB installed

● package 17MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Evtx

✓ from Evtx import Evtx

✗ from evtx import Evtx

Open an EVTX file and iterate over records; each record contains 'event_data' (XML string) and 'data' (raw string when JSON not available).

from evtx import PyEvtxParser parser = PyEvtxParser('example.evtx') for record in parser.records(): print(record['data'])

evtx_dump --version

Debug

Known issues

breakingPython 2.7 support removed in v0.8.0; Python 3.8+ required. v0.7.x development had pinned dependencies due to Python 2 deprecation. Upgrade to v0.8.1.

fix

Upgrade python-evtx to v0.8.1 and use Python >=3.8.

affects: <0.8.0

gotchaThe module name is 'evtx', not 'python_evtx' or 'PyEvtx'. Import with 'from evtx import Evtx'.

fix

Use correct import: from evtx import Evtx or from evtx import PyEvtxParser

affects: all

gotchaLarge EVTX files can consume significant memory if records are loaded all at once. Use the iterator interface (parser.records()) rather than converting to a list.

fix

Iterate over parser.records() instead of list(parser.records()) for large files.

affects: all

deprecatedThe lxml library is optional but recommended for XML output. Without lxml, XML generation may fall back to a less robust implementation.

fix

Install lxml via pip to ensure full XML support.

affects: all

Upgrade

Version history

0.8.1latest on PyPI · released May 2, 2025

Audit

Dependencies

lxmloptionalUsed for XML output of event records

sixoptionalCompatibility layer (deprecated in v0.8.0 but may still be pulled)

Agent activity

117 hits · last 30 days

node

112

Resources

githubhttps://github.com/williballenthin/python-evtx ↗

packagehttps://pypi.org/project/python-evtx/ ↗