Open EVTX files in your browser
The logs Windows keeps of what happened on a computer: services starting, apps crashing, sign-ins and updates. Read one right here, on any computer. Nothing leaves your device.
Or drop it anywhere on this page
What you'll see
Your event log opens as a row for each event, the first ones on show while the rest are read.
- A row for each event • Time, level, source, ID and computer
- Sort and filter • Counts for every column
- Each event's XML • Its data and the user
- Export • Save as CSV, Excel, JSON or Parquet
About EVTX
Windows Vista brought the EVTX event log in 2007, and every Windows since keeps its logs in it: Application, System and Security in C:\Windows\System32\winevt\Logs, and a log of their own for many apps and parts of Windows. Event Viewer opens them, and only on Windows, so a log someone sends to a Mac or a phone has nothing to open it.
A log is a file header and chunks of 64 KB, each holding its events as binary XML: who logged the event, its ID, level and time, the computer, the user and the event's own data. A chunk keeps each kind of event's layout once, as a template the later events fill in. When the log is full, Windows writes over its oldest events.
Filepeek reads the events in a worker as you scroll: a row for each, with its time in UTC, level, source, event ID, computer, user and data, and the whole event as XML in its card. Sort, filter and search them like any table. The message Event Viewer shows comes from the app that logged the event, which isn't in the file, so Filepeek shows each event's own fields instead.
Windows event log
.evtx
Format
- MIME type
- application/octet-stream
- Made by
- Microsoft
- Released
- 2007
Inside the file
- Holds
- Events, as binary XML
- Each event
- Time, level, source, ID and data
- Chunks
- 64 KB, the oldest written over
- Made by
- Windows, Vista on
Opens in every browser
Filepeek opens EVTX event logs in Chrome, Edge, Firefox and Safari, on Windows, Macs, Linux and phones. On their own, browsers only download them.
- YouChromeOpens through Filepeek
- YouEdgeOpens through Filepeek
- YouFirefoxOpens through Filepeek
- YouSafariOpens through Filepeek
Apps that open EVTX
- WindowsEvent Viewer, built in
- MacNo app built in opens it
- iPhone and iPadNo app opens it
- AndroidNo app opens it
Questions
How do I open an EVTX file on a Mac?
Drop it on this page or press Peek an EVTX. Every event shows as a row, with nothing to install and no Windows needed.
Why don't I see the message Event Viewer shows?
Event Viewer takes an event's message from the app or the part of Windows that logged it, on the computer it runs on. The log keeps only the event's fields, so Filepeek shows those: its source, ID, level and data, and the whole event as XML.
Where does Windows keep its event logs?
In C:\Windows\System32\winevt\Logs: Application.evtx, System.evtx, Security.evtx and a log for each app and part of Windows that keeps one. Copy one out, or save it from Event Viewer with Save All Events As.
How do I find the errors in a log?
Sort or filter by Level, or search for a source or an event ID, like 41, which Windows logs when it starts again without having shut down.
What do Audit Success and Audit Failure mean?
They are the Security log's levels: a sign-in, a change to an account or another action Windows was set to audit, and whether it was allowed.