problems about './chainsaw search -t 'Event.System.EventID: =4104''

[cccrrrzz]

why some .evtx document error 'Failed to search file... - Failed to parse chunk number 7' or 10 or 2
with code
/chainsaw search -t 'Event.System.EventID: =4104'

[alexkornitzer]

I assume this is the latest build of Chainsaw? If so I am going to probably need access to the log (if possible) that caused the error so I can see what the evtx library is not liking and get it reported/fixed upstream.

If you can't share it because its sensitive, if you run evtx_dump and get the same error then we can raise the issue direct with upstream and work out how to proceed.

[cccrrrzz]

By the way, I am doing the windows system file log report, so the report must be complete and accurate

[alexkornitzer]

Yep so in this case the error is not a problem if you trust the source of the evtx, both Windows Event Viewer and the EVTX parser are both outputting the same number of events (1672). You are going to be getting no hits because there will be none in there with the ID 4104. If you do a different ID like 7036 you will get hits.

It should be outputting warnings if it skipped anything due to error, that looks like it might be a bug. I will have a look at that.

[cccrrrzz]

I took your suggestion and success ,thank u very much my bro

[hippyjm]

Good afternoon.
I cant seem to find some more explanation for why this error pops up when running Chainsaw.
I can see that in event viewer we have 2495 events and in evtx parser i get 2495 so the numbers match. However i dont fully understand why its throwing this error then.
Everything is working a dream other than that. Its just having to check and make sure they match up

[alexkornitzer]

Hi @hippyjm,

Without access to the sample its hard for me to say absolutely but either this is happening at the end of an evtx file as it could be truncated. And/or if the numbers are matching with Microsoft event viewer then usually its just the evtx library being more vocal about parsing errors.