Event Log Triage / User guide

Event Log Triage user guide

How to get events into the app, find the one you need, and keep or share what you found. Plain language, and nothing the app does not do.

Who it is for

People who are handed a Windows problem and have to find out what happened from the event logs:

• Sysadmins and help-desk tier 2 who own a few dozen to a few hundred Windows machines and triage "it rebooted", "the service died", "logons are failing" without a SIEM.
• MSP technicians who get .evtx exports from customers, or who can reach a customer's machine by name but not comfortably by RDP.
• Incident responders and students working through saved logs from a lab or a case.

It is not for continuous monitoring, alerting, or log retention. Those are jobs for an RMM or a SIEM; this app is for the hour when you need to read what is already there.

Requirements

• Windows 10 version 1809 or later, or Windows 11, on an x64 (64-bit Intel or AMD) PC.
• The Microsoft Store installs the app and the Windows App Runtime it depends on. No other setup.
• To read a live channel on this computer: an ordinary user can read Application, System and most operational channels. The Security channel and some others need the app run as administrator, or membership in the Event Log Readers group.
• To read a remote computer:
  1. The remote computer must allow remote event log access: enable the "Remote Event Log Management" rules in Windows Defender Firewall, or run

     netsh advfirewall firewall set rule group="Remote Event Log Management" new enable=yes

     on it once.
  2. Your account, or the credentials you type, must be in the Event Log Readers group (or Administrators) on the remote computer. Domain accounts work with no extra step; workgroup machines usually need explicit credentials.
  3. Name resolution and RPC (TCP 135 plus dynamic ports) must reach the machine. If ping name fails, the app will too.

  Event descriptions for a remote machine are rendered using the provider metadata on this computer. Microsoft providers are present everywhere; a third-party product installed only on the remote machine shows its raw event data instead, and the Fields tab says so.

Getting events in

• Open .evtx (Ctrl+O), drag files onto the window, or double-click an .evtx file once the app is installed.
• Add live channel lists every channel on this computer with the common ones first; type to filter the list.
• Add remote machine asks for a computer name, a channel, and optional user name and password. Credentials stay in memory for the connection only.
• Every source goes into the same list, sorted by time, with a Computer column so machines stay distinguishable. Remove a source with the × beside it.

Finding the event

Work from coarse to fine; every control combines with the others and the status bar shows the match count.

1. Level first. Tick Critical and Error to see what actually broke, then add Warning.
2. Time. Use 1 h, 24 h or 7 d, or type a From/To. Narrow to the minutes around the symptom.
3. Provider or Computer checkboxes with counts. "Show only this provider" on the right-click menu does it from a row.
4. Event IDs when you know them: 4624, 4625 for logons, 1000-1010 for a range, !1005 to exclude one. Combine: 6005-6009, 41, 1074 for reboots and shutdowns.
5. Search (Ctrl+F) for text anywhere in the message, provider or computer name.

Select a row to read the full message, the parsed fields (including the resolved account name for a SID) and the raw XML. Each has a copy button. Ctrl+Shift+C copies the selected row as one tab-separated line that pastes into a ticket or spreadsheet.

Keeping and sharing results

• Saved filters: once a combination works ("Unexpected shutdowns", "Failed logons last 24 h"), save it by name from the Saved filters menu and reload it next time. They live in %LOCALAPPDATA%\EventLogTriage\filters.json, which can be copied to a colleague.
• Export writes exactly the rows you see to CSV (opens in Excel) or JSON (for scripts), with the account name resolved where possible.

Recipes

Trial and purchase

• The Store version can be tried free for 7 days. During the trial a bar at the top of the window shows the days left and a Buy Event Log Triage button, which opens the Microsoft Store purchase dialog. Close the bar with its × to hide it until the next time the app starts.
• Everything works during the trial. Buying turns the same installed app into the full version; the bar disappears and nothing is reinstalled.
• When the trial ends the Microsoft Store normally stops the app from starting until it is bought. If it does start, events can still be opened and read, but Export is turned off and the bar says "Your trial has ended."
• The purchase is tied to the Microsoft account signed in to the Microsoft Store app. On another computer, sign in to the Store with the same account and install it from there.
• If the Store cannot be reached, the app does not lock you out; it runs as the full version.
• Rating: once the app has been started at least three times over at least two days, it asks for a rating once, through the Microsoft Store's own dialog, after you open a log. It never asks again and offers nothing in return. Rate this app in the More options menu (the ... button at the right of the toolbar) opens the same dialog at any time.

Limits worth knowing

• Everything is read into memory: roughly 1.5 KB per event. 500,000 events need about a gigabyte.
• No live tail; re-add the channel to refresh.
• Reading is one way. The app never clears, writes or forwards a log.
• No telemetry, no account, no network use other than the remote connection you add and the Microsoft Store's own licence, purchase and rating requests.

Something not covered here? See Support or write to [email protected].

Get Event Log Triage

Free 7-day trial, then a one-time purchase: $9.99 on the Microsoft Store.

Get it from the Microsoft Store Open in the Store app