Log file formats

Files in which the operating system and its services record what happens: start ups and shut downs, sign ins, errors and warnings. Some are plain text with one event per line, and some are binary files built for fast searching.

Formats

.EVT

Windows event log (legacy)

Windows XP-era event logs: a ring of LfLe records after a 48-byte header.

.EVTX

Windows XML Event Log

Windows event logs: 64 KB chunks of records stored as binary XML.

.JOURNAL

systemd journal

Linux’s binary system log: entries as indexed FIELD=value pairs.

.LOG

Common Log Format

Apache and nginx access logs: one request per line, in fixed fields.

.LOG

Plain text log

One event per line of text, usually led by a time, as syslog writes it.

.LOG

W3C Extended Log File Format

IIS web logs: a #Fields directive names the fields on every line.