Added README and LICENSE.. Updated build.bat with my current configuration..

Author: CodeMangler

Console Client/Properties/Resources.cs

@@ -0,0 +1,85 @@
+//------------------------------------------------------------------------------
+// <auto-generated>
+//     This code was generated by a tool.
+//     Runtime Version:2.0.50727.4952
+//
+//     Changes to this file may cause incorrect behavior and will be lost if
+//     the code is regenerated.
+// </auto-generated>
+//------------------------------------------------------------------------------
+
+using System;
+
+
+
+/// <summary>
+///   A strongly-typed resource class, for looking up localized strings, etc.
+/// </summary>
+// This class was auto-generated by the StronglyTypedResourceBuilder
+// class via a tool like ResGen or Visual Studio.
+// To add or remove a member, edit your .ResX file then rerun ResGen
+// with the /str option, or rebuild your VS project.
+[global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
+[global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+[global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
+internal class Resources {
+    
+    private static global::System.Resources.ResourceManager resourceMan;
+    
+    private static global::System.Globalization.CultureInfo resourceCulture;
+    
+    [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")]
+    internal Resources() {
+    }
+    
+    /// <summary>
+    ///   Returns the cached ResourceManager instance used by this class.
+    /// </summary>
+    [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
+    internal static global::System.Resources.ResourceManager ResourceManager {
+        get {
+            if (object.ReferenceEquals(resourceMan, null)) {
+                global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("Resources", typeof(Resources).Assembly);
+                resourceMan = temp;
+            }
+            return resourceMan;
+        }
+    }
+    
+    /// <summary>
+    ///   Overrides the current thread's CurrentUICulture property for all
+    ///   resource lookups using this strongly typed resource class.
+    /// </summary>
+    [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
+    internal static global::System.Globalization.CultureInfo Culture {
+        get {
+            return resourceCulture;
+        }
+        set {
+            resourceCulture = value;
+        }
+    }
+    
+    /// <summary>
+    ///   Looks up a localized string similar to Available options:
+    ///  Pre-filters::
+    ///    Time: -after -before -at
+    ///    Type: -type :: Error|FailureAudit|Information|SuccessAudit|Warning
+    ///    Message: -startsWith -contains
+    ///    Computer: -computer
+    ///    Source: -source
+    ///    EventId: -eventId
+    ///
+    ///  Processing options:
+    ///    -tolerance :: Tolerance threshold for determining similarity of two Event log messages.
+    ///                  Defaults to 0. i.e. Maximum accuracy =&gt; Least fuzzy =&gt; More groups
+    ///    
+    ///  Output options: 
+    ///    Fields in output reports: -include [rest of string was truncated]&quot;;.
+    /// </summary>
+    internal static string HelpText {
+        get {
+            return ResourceManager.GetString("HelpText", resourceCulture);
+        }
+    }
+}

EventLogAnalyzer.sln

@@ -4,6 +4,8 @@ Microsoft Visual Studio Solution File, Format Version 11.00
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{2300BCDB-659C-42FC-8539-EBC36B9FBFD4}"
 	ProjectSection(SolutionItems) = preProject
 		eventloganalyzer.build = eventloganalyzer.build
+		LICENSE.txt = LICENSE.txt
+		README.txt = README.txt
 	EndProjectSection
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "EventLog", "EventLog\EventLog.csproj", "{540AA583-6BC3-4894-9A9F-44438F3955E5}"

LICENSE.txt

@@ -0,0 +1,5 @@
+Copyright (c) 2007 CodeMangler
+
+This application is dual licensed.
+Non-profit and non-proprietary usages are subject to the GNU GPL License (http://www.gnu.org/licenses/gpl.html).
+Commercial and/or proprietary usage of the application and/or it's derived works must obtain a commercial license from the application's author.

Output/Analyzer.exe

@@ -0,0 +1,41 @@
+EventLog Analyzer
+=================
+
+This is a utility I wrote a few years ago for automating analysis of Event Log files exported from production machines.
+The idea was to automate identifying and classifying similar Event Log records to get a quick overview of all the failure types and to focus on and fix the most frequent failure types.
+
+It reads a bunch of Event Log files (*.evt) and automatically groups related Event Log records based on their similarity.
+Once the analysis is complete, it writes out a CSV each for every group of related events found, and a summary text with a bunch of statistics.
+You can provide it some filters that tell it to look at only the Event Log records that match a certain criteria.
+
+Warning: It could be quite slow if you're processing a large number of Event Log records.
+
+Hopefully, I'll get around to fixing the performance when I get some time (now that I've reopened the project after over 3 years :D).
+
+### Commandline Options:
+  Pre-filters::
+    Time: -after -before -at
+    Type: -type :: Error|FailureAudit|Information|SuccessAudit|Warning
+    Message: -startsWith -contains
+    Computer: -computer
+    Source: -source
+    EventId: -eventId
+
+  Processing options:
+    -tolerance :: Tolerance threshold for determining similarity of two Event log messages.
+                  Defaults to 0. i.e. Maximum accuracy => Least fuzzy => More groups
+    
+  Output options: 
+    Fields in output reports: -include (FieldNames|All) :: FieldNames:= Type|DateTime|Source|Category|EventId|User|Computer|Message
+    Output Folder: -output :: Folder must exist
+
+References
+----------
+* CodeProject article on parsing Event Log files: http://www.codeproject.com/KB/string/EventLogParser.aspx, by [J a a n s](http://www.codeproject.com/Members/J-a-a-n-s)
+* MSDN Reference on Event Log file format: http://msdn.microsoft.com/en-us/library/bb309026(VS.85).aspx
+
+TODO:
+-----
+* Improve performance (Parallelize log record comparisons?)
+* Bring back/rewrite the GUI client
+* Refactor/cleanup.

Output/EventLog.netmodule

@@ -1,8 +1,8 @@
-SET SOLUTION_DIR=C:\Workspace\Development\C#\VS.NET 2005\EventLogAnalyzer
+SET SOLUTION_DIR=C:\Workspace\Development\C#\Visual Studio\EventLog Analyzer
 SET CONSOLE_CLIENT=%SOLUTION_DIR%\Console Client
 SET EVENT_LOG=%SOLUTION_DIR%\EventLog
 SET OUTPUT_DIR=%SOLUTION_DIR%\Output
-SET PATH=%PATH%;"C:\Program Files\Microsoft Visual Studio 8\SDK\v2.0\bin"
+SET PATH="C:\Windows\Microsoft.NET\Framework\v2.0.50727";C:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\Bin;%PATH%
 
 cd "%EVENT_LOG%"
 csc /t:module /out:"%OUTPUT_DIR%\EventLog.netmodule" "%EVENT_LOG%\*.cs"