how to open a saved eventlog file with display information

17,501

Solution 1

If your MS Exchange Server resides on Windows Server 2008 OS, then you seem to be a lucky guy. I've just tried to right-click on Application log and chose "Save All Events As..." option. Then I specify xml as output format. Then you have an option to export or not to export Display Information. Click Save to save.

enter image description here

Unfortunately, no possibility to save as xml on Windows Server 2003, only txt/csv.

Tried to connect to remote Event Viewer from W2k8 to W2k3 server, but still cannot export to xml.

Solution 2

After exporting the Windows event as documented here, there should be two files: an evtx file you saved and a LocaleMetaData folder in the same directory that should contain a .MTA file with the same name as the evtx file.

To correctly view the events on another computer, you need to copy both the evtx file and the LocaleMetaData folder and its contents onto the other computer.

17,501

user1008764

Updated on September 18, 2022

Comments

user1008764 almost 2 years

i saved an eventlog with display information on a computer. now i want to open this file on another computer with full event description. in my understanding this information should be saved in the LocalMetaData.mta file but i don't know how to use this file. how can i "import" the .mta file in order to get full eventlog description on the other computer?
- Volodymyr Molodets over 11 years
  
  which eventlog do you want to open? Application\Security\System? Security\System should open Ok, Application may not - you need to have specific application installed to view its logs writted to windows Application log.
- user1008764 over 11 years
  
  it's the application log. and i want to see exchange entries
- Volodymyr Molodets over 11 years
  
  Either install Exchange or look for files with descriptions in installation folder of Exchange on source server.
- Volodymyr Molodets over 11 years
  
  Which OS version is installed on Exchange server? 2003? 2008?
- user1008764 over 11 years
  
  On Windows Sevrer 2008 R2
- user1008764 over 11 years
  
  i do not want to install the exchange admin tools. i think all data should be saved int the .mta file but i don't know how to use this file
- Ashley over 9 years
  
  Was an answer ever discovered here? This issue is affecting me too. I assumed including the LocaleData would be enough, but having it in the same structure as when it was exported doesn't seem to work. Opening on a different machine I'm being told the error description text doesn't exist.
- Kevin over 6 years
  
  I just test saved a few events to a evtx file, which generated an LocaleMetaData*.MTA file. It deleted the MTA and it didn't seem to affect my ability to view the event descriptions
user1008764 over 11 years

yes i know this. i have saved it with display information as evtx file because i would like to open it in eventvwr. my problem is that i can open the evtx file but not the meta data (.mta) file with the event descriptions
Ashley over 9 years

This answer does not address the question asked.
Kevin over 6 years

DisplayInfo.evtx vs NoDisplayInfo.evtx both were binary identical. the first did create an LocaleMetaData\DisplayInfo_1033.MTA