Version history

running tasks from the command line.

an option to start with the last saved workspace.

an option to hide main toolbar to display more information.

a log view scaling control.

import from task (or template) into XML query filter.

tab sorting (added sort by tabname).

UI for better high DPI exerience.

application!

new TSApps methods

an option to limit a number of displayed records.

performance of description rendering for some events.

a bug with rendering descriptions when it contains some special symbols.

a UI bug when displaying Color Coding dialog.

minor bugs.

new UI classes.

Some functions stopped work in version 5.5.0. Now working.

an option "Treat value as" for the custom columns. Custom columns are now typed (Text, Integer, Float, Date).

an option to make the filter case sensitive.

an option not to save the workspace when quit.

"Go to date" command.

analytical report (Custom Column 1 advanced stats).

task template (New external device detected).

a task template (Audit printer usage).

a bug with removing a task from the tree.

minor bugs.

an option to calculate custom columns using a "formula" (script).

a global object SGlobals to store data

new functions

backward search option.

analytical report (Types and Categories).

task templates.

UI.

a bug with incorrect description rendering for some rare events.

Description box refresh after sorting.

a bug with incorrect time format for some locales.

minor bugs.

SMTP protocol now works only over TLS 1.2 (support of 1.0 and 1.1 stopped for security reasons).

Event Log Explorer viewer could block events table and cause events to be lost from Elodea collector.

Maximum number of custom columns increased up to 30.

a custom column helper that simplifies custom column creations.

support of legacy (v. 4.x) custom columns in format Level\sublevel.

command line option to set the filter (/SETFILTER).

UI.

several bugs.

You can refresh Imaged computer in the tree - no need to remove/add a new imaged computer anymore.

an option to set the maximum custom columns number.

import computers from Active Directory (via LDAP).

Time correction now works with DST.

system time zones for time correction.

browse for computers.

Multiple delete from the tree.

Filter by custom fields didn't work in some cases.

and improved import of computers list.

several minor bugs.

in Elodea settings.

new functions.

filter by description parameters.

a new function in scripting.

Objects tree now displays events number in subfolders.

several minor bugs.

Unquoted Service Path vulnerability for Elodea service.

working with imaged disks.

forensic opening.

searching for removed events feature.

deep scan feature.

snapshot features.

scripting.

scripting.

filtering and sorting.

in UX.

bugs.

in list/not in list operators in Filter by custom fileds.

Add computers wizard

EventID.net knowledgebase support since it doesn't work anymore.

incorrect event description rendering for some events.

several minor bugs.

"Copy cell contents to clipboard" (in the log drop-down menu).

filtering by description content.

incorrect event description rendering for some events.

Color coding by event description.

Event description could be highlighted depending on search, filter or color-coding conditions.

compatibility with Windows 11.

task template added.

several bugs.

a bug linked with event rendering description from remote servers.

You can now filter in the most of popup lists, e.g. list of sources or list of logs.

UTC timezone option added in the Timezone dialog.

several task templates.

a bug with regular expression filtering.

minor bugs.

entity - "Task". You can form a task as a set of different event logs, files (or XML query) with your own presets - filter, display options etc.

Predefined task templates to perform standard administrative tasks.

Temporary log storage is now always on the disk.

Search and filter by custom columns.

Custom columns are now based on XML values.

Full UNICODE support.

Application windows now can be scaled (manually or automatically depending on DPI).

Database tables (logs) are in the tree.

Query Builder to the XML query filter.

Quick Filter by bookmarked/non-bookmarked events

fine-tune settings to get events from the database.

A lot of new minor options.

Logs in the tree are now displayed in standard hierarchy.

performance and memory consumption.

time correction option.

diplaying on High DPI monitors.

bugs.

handling of inconsistent event details.

minor bugs.

merged log view properties dialog - it lets you remove a log from a merger.

description param filter by regular expression.

minor improvements.

Statistics panel option for log view.

support of new event type (level: verbose).

option to display time in UTC for new log windows.

options to display date and time in different formats.

default storage to disk (you can switch it back to memory in Preferences).

Eldbx utility.

several bugs.

batch backup utility ElbackX.

several minor bugs.

Log Readers group now can access remote Security logs (no admin rights required).

logs are now sorted in the tree and some lists.

program could fail to authenticate user names in legacy (domain\user) format. Fixed.

a new filed (usertag) in DB export.

a vulnerability which may lead to XML injection attack.

coding by type bug fixed.

a minor bug with event descriptions.

with Elodea (COM server).

log command now clears SQL table when required.

Elback utility.

Eldbx utility.

minor bugs in event filter.

to database added.

logs from a database added.

for unattended event log export added.

some informational dialogs.

minor bugs.

into a new view command added (available in computer tree popup menu).

all event views command added.

filter by custom columns (works with Memory data storage only).

analytical report on a custom column.

minor bugs and some typos.

smartcopy to clipboard option.

number of selected events in status bar.

event descriptions displayed incorrectly in Windows 10/2016. Fixed.

minor bugs.

bug preventing log loading if they have invalid dates in event description

minor bugs

queries (New API).

time in UTC.

time correction options (1-minute resolution).

color coding (added color code by type and source).

credential management.

fixes and improvements.

event descriptions displayed incorrectly (NewAPI). Fixed.

memory leak in event alerter.

custom columns.

custom columns (Up to 2 custom columns, horizontal layout).

columns sorting (for in-memory storage only).

event(s) copy (Excel compatible).

computer in the tree.

to store event alerter.

scheduled export.

can pre-filter events in log loading options by source.

and exceptional filters in log loading options (using comma and exclamation mark).

select API dialog by default - it will use New API when possible.

bug with layout of Filter/Search dialog.

serious memory leak bug (New API).

bug fixes and improvements.

fixes and improvements.

Custom columns - you can extract information from description and display it in event list.

alerts by event type.

Event description could be missing for some events. Fixed.

Event category could be miscalculated for some events. Fixed.

window improvements.

new analytical reports.

import tree options (when you import from a text file).

to show Record number.

on tabs to display helpful information.

fixes and improvements.

by description params (for security logs).

may compare events by source (not only by source+event id).

of UI bugs fixed.

access to evtx files. You can now open evtx files even from Windows XP.

number of events in the tree (for New API only).

and drop in the tree.

Alerter handles Event Description. (Use [Description] field).

for event in Google added.

All Logs In Merger View now works with subfolders.

log file open.

descriptions from Windows 2008+ servers were inaccessible sometimes - fixed.

minor bugs.

Alerter.

to display only new events after refresh.

to autofit columns after load.

view XML view of event (for new event api only).

charts in analytical reports.

UI improvement options.

visual styles.

export options.

some bugs.

filter popup on the main toolbar added.

credentials manager behavior.

of new event API to access more event logs on Vista, 7, 2008.

manager to store credentials and use them on log opens.

filtering on linked events.

reports - different summary tables.

view of event (for new event api only).

to disable filter temporarily.

to disable log loading options temporarily.

quickfilter: Source+EventID.

minor bugs.

Scheduler

tabs in Windows 7/2008 R2

configuration

Data Execution Protection (DEP) compatibility

export to XLSX

consumption optimized

problem with incorrect margins on printed documents

leaks fixed

minor bugs

to Excel 2007

to store temporary data on disk instead of memory.

decreased memory consumption.

interface improvements.

log files location is stored in the workspace.

minor bugs.

event log and event log file merging.

correction for any log views.

default prefilter by Event ID (see Log Window Defaults).

default description server option.

default color coding (see Log Window Defaults->Appearance).

description and category reading.

in Event Properties displayed incorrectly - fixed.

exported incorrectly during raw export - fixed.

bug with long data truncation.

long regular expressions in filter work incorrectly - fixed.

Windows 2000 compatibility issue.

minor bugs.

rewritten event log caching - it's database compatible now.

compatibility with Windows Vista x64.

can specify a server where Event Log Explorer will look for descriptions.

styles support (MS Office-like, Whidbey).

is up to 10 times faster than in version 2.x.

interface improvements.

minor bugs.

a bug which could extremely slow down event log loading process.

displayed or selected events to EVT file added.

by criteria added.

and print binary data.

of 3GB address space (/3GB switch in boot.ini).

description dialog added.

languages (Russian, Polish).

module added.

filter/search by user and computer.

consumption optimized.

internal improvements.

compatibility issue with data execution protection on Vista.

minor bugs.

access to .evt files added.

backup utility and backup integration option added.

Event ID color coding options.

Vista compatibility.

files can be added to the tree.

minor bugs.

updated.

modified.

minor bugs.

user interface models added (MDI and TDI).

log backup to any computer.

can display event description in the event list.

can filter several event logs at once.

memory manager - improved performance.

with different credential can now disconnect previous sessions.

correction didn't work correctly on some systems - fixed.

minor bugs.

regular expressions search/filter by description.

improved performance of large logs loading.

by source might work incorrectly for log files. Fixed.

concept. Workspace files to store program state.

can grouped in the tree.

pages for computers and groups.

to search and bulk add computers to the tree.

font option added.

correction property added.

filter/search criteria to perform more advanced filtering.

of Windows Vista logs added.

improved performance of date/time sort.

tree is now multi-selectable.

user interface improvements.

menu appears again in the description box.

minor bugs.

performance of large logs loading.

minor bugs.

user interface improvements.

a bug with an exception in mshtml.dll.

minor bugs.

to Excel format

option to open new window maximized.

backup of event log.

log loading options - prefiltering by event type.

a bug with reading Windows NT 4.0. event logs.

minor bugs.

can view event data in binary format.

Computers Tree (into/from XML file).

events with descriptions added.

selected events added.

can sort computers in the Computers Tree.

Quick Filter options: select events older or younger then specified.

events selection (you can e.g. copy them into clipboard at once).

all logs from one computer by one command.

all logs from one computer by one command.

events bookmarks.

preferences dialog.

partial load logics.

minor bugs.

to load logs partially (only fresh events).

log window defaults (sort order, dimensions).

can associate Event Log Explorer with EVT files.

to poll for program updates automatically.

exception catching.

logs are loaded in background - you don't have to wait until a log will be loaded.

in event descriptions are now clickable.

descriptions were displayed incompletely - fixed.

a bug with date/time filtering.

minor bugs.

event description along with the event data.

to lookup event information in public event knowledge bases.

inverted quick filter (NOT EQUAL).

to open items by a single-click, select by point.

and drop of EVT file on Event Log Explorer main window.

can copy current event to a clipboard.

a command to Computers Tree popup menu that closes all related event logs.

tree now can save its state.

user interface improvements.

and time in report were displayed as UTC date/time - time zone corrected.

order problem is fixed in report.

a bug with incorrect date and time export.

text file could contain extra paragraph breaks - fixed.

filter clearing, the last selected event went away - fixed.

As dialog appears if the access denied failure occurs when connecting remote computers.

minor bugs.

command line options.

tree now works asynchronously.

refresh interval changed to 1 second.

a bug with event id search/filter criteria.

a bug with incorrect description displaying from remote computers when administrative shares were disabled.

the remote event logs now works correctly.

minor bugs.

auto-refresh commands.

new "!" operator for event ID filter/search criteria.

event list navigator.

new event log window preferences.

changed filter behavior - no cascaded filters anymore (except quick filters).

command does remember filter condition.

minor bugs.

report preferences added

autosave options (log window keeps position, sorting modes, etc).

user interface.

minor bugs.

ID exception criteria added.

of confirmations options added.

of autosave options added (it is possible to keep window size, position and opened logs).

Log Window options added.

improved performance on getting event descriptions.

a problem with getting event descriptions from remote computers.

minor bugs.

beta version.