Windows Event Viewer works for a quick look at one local log. Once Windows events become part of your regular work, its limits cost time: multi-log investigations are awkward, remote systems are cumbersome to manage, and reusable analysis setups are limited. A dedicated tool should let you move from an alert or symptom to a repeatable investigation without rebuilding the same view every time.
Learn how to troubleshoot common connectivity and authentication issues when accessing remote Windows event logs. This guide covers the most frequent causes of failures, including firewall and RPC configuration, permissions, UAC restrictions, Kerberos authentication, VPN-related issues, and time synchronization problems.
Unlock deeper insights into your logs with the power of AI. Learn how Event Log Explorer’s integration with Microsoft Copilot can streamline your workflow and enhance your event analysis.
Windows PowerShell provides several methods to filter event logs. In this article, we compare their performance to find the fastest. We also compared PowerShell log filtering with our Event Log Explorer scripting.
A serious bug in the Windows Event Log API events to show the same task category. It affects most third-party log viewers and even PowerShell — only Windows Event Viewer displays the correct data.
We released Event Log Explorer 5.7.2, which includes robust workarounds for this Windows API bug.
We’re excited to announce the release of a new beta version of Event Log Explorer Forensic Edition (5.6), featuring a game-changing update: native 64-bit support! This upgrade significantly enhances Event Log Explorer’s capabilities, especially for users working with large event log datasets. Here’s why: Breaking the Memory Barrier While Event Log Explorer efficiently loads event logs into a temporary local database, it still requires memory… Read More »
Approximately 10 years ago, we introduced custom columns in Event Log Explorer. This feature allows users to extract event details from the event description or event XML. Custom columns have significantly enhanced our customers’ ability to get more information from events, and we have continuously improved it across different versions. Previously, Event Log Explorer treated custom column values as text, which sometimes was insufficient for… Read More »
Starting from version 5.1 Event Log Explorer comes with scripting support (scripting is implemented in the forensic and enterprise editions). Scrips help you automate many routine tasks and improve your performance. Scripting lets you can open logs, set filters, scan event views, remove specific events from a log view, export events and many more. The scripting language we use in Event Log Explorer is PascalScript… Read More »
Taking snapshots is one of the great new features in the Forensic Edition. Whenever you need to save a set of events for future analysis, you can take a snapshot and then load it without access to the original log or log file. Snapshots are like event log backups, but there are some differences. While backups work with the entire event log (or in some… Read More »
In this article, I will show how to work with damaged event log files. Event Log Explorer forensic edition can extract events from damaged files. Let’s take a log file (e.g. a security log file) and open it with Event Log Explorer using File-> Open Log File. Event Log Explorer opens this file as it always does. Now we will intentionally corrupt this log. I… Read More »