EVTX viewer
To open a EVTX file, drop it in the box below. It opens straight away, even with no extension or the wrong one. Your browser opens it on your device: nothing is uploaded.
What you see
| EVTX in the viewer | |
|---|---|
| Read by | Our own reader: templates, substitutions and nested binary XML, in a worker |
| Events listed | Up to 1,000,000 |
| Damaged logs | Unreadable chunks skipped and counted, checksums reported |
| Not shown | Message text, which lives in DLLs on the computer that wrote the log |
| Extensions | .evtx |
| Upload | None: opened on your device |
What is a EVTX file?
EVTX is the Windows event log format: Event Viewer’s System, Application and Security logs, saved as binary XML in 64 KB chunks.
Every event as a row in the table viewer: time, level, event ID, provider, computer, channel, record ID and the event’s data as Name=value. XML shows each record as Event Viewer’s XML view would, and a record ID finds one. Details lists the levels, channels, providers and computers, with any damaged chunks or checksums that do not match.
How to open a EVTX file
- Add your EVTX. Drop the file in the box, choose it or paste it.
- Look at it. Every event as a row in the table viewer: time, level, event ID, provider, computer, channel, record ID and the event’s data as Name=value. XML shows each record as Event Viewer’s XML view would, and a record ID finds one. Details lists the levels, channels, providers and computers, with any damaged chunks or checksums that do not match.
- Take it further. Open in hands it, in a new tab, to File converter.
Questions
Drop it here: it is read in your browser on any computer.
In C:\Windows\System32\winevt\Logs, or saved from Event Viewer with Save All Events As.
No. It stays on your device.
No. The viewer runs in your browser and opens the file on your device. Nothing is sent anywhere.