You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Runnig EvtxECmd.exe -f .\audit_ncstcifs_D2022-08-17-T15-19-18_0000000000.evtx --inc 4663
Produces an Error and 0 records are processed: Error processing C:\PATH\audit_ncstcifs_D2022-08-17-T15-19-18_0000000000.evtx! Message: unknown tag to build for opCode: TokenCharRef2 (0x00000048) at position 0xCC
To Reproduce
Steps to reproduce the behavior:
Run the command, regardless of arguments, against a NetApp evtx file
Expected behavior
Either to work as expected or Continue converting with warning about missing parts
Screenshots Error processing C:\PATH\audit_ncstcifs_D2022-08-17-T15-19-18_0000000000.evtx! Message: unknown tag to build for opCode: TokenCharRef2 (0x00000048) at position 0xCC
.
Additional context
Those Logs are generated on NetApp
The text was updated successfully, but these errors were encountered:
@maysara do you have any sample data you can provide?
A sample of 2MB chunk: https://hostb.org/26XW
pwd is @+your twitter handle
Please remove File with: 578ZHW
@maysara do you have any sample data you can provide?
A sample of 2MB chunk: https://hostb.org/26XW
pwd is @+your twitter handle
Please remove File with: 578ZHW
Got it, thank you! I've been able to recreate the issue. I passed the .evtx on to Eric.
These problems came with netapp logs.
I get this Error too:
\Downloads\EvtxECmd\EvtxeCmd\audit_ncstcifs.evtx! Message: unknown tag to build for opCode: TokenCharRef2 (0x00000048) at position 0xCC
EvtxECmd version #
EvtxECmd version 1.0.0.0
Describe the bug
Runnig
EvtxECmd.exe -f .\audit_ncstcifs_D2022-08-17-T15-19-18_0000000000.evtx --inc 4663
Produces an Error and 0 records are processed:
Error processing C:\PATH\audit_ncstcifs_D2022-08-17-T15-19-18_0000000000.evtx! Message: unknown tag to build for opCode: TokenCharRef2 (0x00000048) at position 0xCC
To Reproduce
Steps to reproduce the behavior:
Expected behavior
Either to work as expected or Continue converting with warning about missing parts
Screenshots
Error processing C:\PATH\audit_ncstcifs_D2022-08-17-T15-19-18_0000000000.evtx! Message: unknown tag to build for opCode: TokenCharRef2 (0x00000048) at position 0xCC
.
Additional context
Those Logs are generated on NetApp
The text was updated successfully, but these errors were encountered: