Questions[wevtutil](server)

TL/DR: Logs working on system with source installed, but display info not getting archived with wevtutil al. When trying to read messages on system without sources installed I get the "description for Event ID from source cannot be found. Either the component that raises this event is not installed ...". Most of my sources' messages get archived correctly, but messages from 2 of them don't.

Full desc: I'm trying to update some of my companies support scripts so that our product doesn't need to be installed in order to read the messages we produce in the event log. This requires running wevtutil epl, and then wevtutil al back to back, and it generates an evtx file and a locale specific MTA file. This works for 4 for our event sources/products, but not for 2 of them. And I can't figure out why. The logs are working correctly on systems with those sources installed, and they all have the correct entry under HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\\EventMessageFile.

I've rebooted both the machine generating the logs, and the machine without the sources installed that I'm testing the archives on. That hasn't fixed the problem. I've also checked the list of publishers with wevtutil ep, and that seems fine.

I have a large number of 2k12 r2 servers and I'd like to keep archives of their Eventlogs every 30 days. I was looking for a centralized solution, possibly a GPO. But from what I saw it's only possible to use Group Policy in order to either archive the logs by filesize or retain them for a certain amount of time. Is there a way to combine between the two to get what I want or am I best to simply script it using wevtutil?

I'm looking to export a large quantity of saved Security log files (.evtx) to text or CSV format. I found wevtutil but that only seems to be able to convert .evt to .evtx when dealing with saved log files:

wevtutil epl c:\logs\seclog.evtx c:\logs\seclog.txt /lf:true

The file is created as seclog.txt but it is in .evtx format.

Is it possible to convert to text or is there another way to convert the files to text as quickly? I tried with Powershell but it takes too long.

Edit: I've looked into Log Parser and it seems quick as well but it doesn't export the description field correctly:

The description for Event ID xxx in Source "Microsoft-Windows-xxxx" cannot be found. The local computer may not have the...