Windows 10: How do you convert ETL to EVTX to forward to WEC server?

I am trying to forward DNS analytics logs to WEC server, but WEF only forwards EVTX format and the logs I have are in ETL format. How can I convert ETL to EVTX?

:)

 

[SOLVED] How can I bulk covert '.etl' files to '.evtx' files?

In Event Viewer, I can open an individual '.etl' file and then convert it to '.evtx' format.

I want to do that for hundreds of 'etl' files.

Is there a bulk method to perform the conversion?

Warm Regards,

Mark.

 

[SOLVED] How can I bulk covert '.etl' files to '.evtx' files?

Thanks for the push.

In a CMD file (I named mine 'DUPLICATE (all).ETL AS EVTX (here) .CMD'),

Code:

for %%a in (*.etl) do tracerpt "%%a" -o "%%a.evtx" -of EVTX

 

Unable to forward events from a source Wins server to a custom event viewer bucket in Event Collector

Hello,

I keep receiving the following error message on the source server (Eventlog-ForwardingPlugin) although I already tried adding "Network Service" to the specified channel and the current subscription is "Source Initiated" and "Network Service" is in the Event
Log Reader Group. Please advise how to fix this issue. Thank you.

"The subscription WEC-*** is created, but one or more channels in the query could not be read at this time."

Channel ACL:

C:\Windows\system32>wevtutil gl WEC-***

name: WEC-***

enabled: true

type: Operational

owningPublisher: WEC

isolation: Application

channelAccess: O:BAG:SYDA;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)

logging:

logFileName: D:\Logs\***\WEC-***.evtx

retention: false

autoBackup: false

maxSize: 10737418240

publishing:

fileMax: 1