how to open a saved eventlog file with display information

i saved an eventlog with display information on a computer. now i want to open this file on another computer with full event description. in my understanding this information should be saved in the LocalMetaData.mta file but i don't know how to use this file. how can i "import" the .mta file in order to get full eventlog description on the other computer?

Solution 1:

If your MS Exchange Server resides on Windows Server 2008 OS, then you seem to be a lucky guy. I've just tried to right-click on Application log and chose "Save All Events As..." option. Then I specify xml as output format. Then you have an option to export or not to export Display Information. Click Save to save.

Unfortunately, no possibility to save as xml on Windows Server 2003, only txt/csv.

Tried to connect to remote Event Viewer from W2k8 to W2k3 server, but still cannot export to xml.

Solution 2:

After exporting the Windows event as documented here, there should be two files: an evtx file you saved and a LocaleMetaData folder in the same directory that should contain a .MTA file with the same name as the evtx file.

To correctly view the events on another computer, you need to copy both the evtx file and the LocaleMetaData folder and its contents onto the other computer.