Skip to content
Analysis

EventSleuth

Event Viewer replacement that doesn't freeze on large logs. Background-threaded queries, virtual scrolling for million-event channels, XPath filtering, and .evtx file import.

Rustegui
View on GitHub Download

Event Viewer works, until it doesn’t — open a busy channel and the MMC snap-in freezes while it pumps a hundred thousand events through the UI thread. EventSleuth is the same data without the hang: it queries on a background thread, only renders the rows you can see, and lets you stack filters down to a narrow outage window. It also opens exported .evtx files from another machine with no extra steps.

What it does

  • Reads Windows Event Logs in a modern desktop UI.
  • Queries logs on background threads so the interface stays responsive.
  • Handles large result sets with virtual scrolling.
  • Filters by log, provider, level, event ID, text, and time range.
  • Exports filtered events to CSV or JSON.
  • Shows event details without opening modal dialog after modal dialog.

Requirements

  • Windows.
  • Permission to read the selected event logs.
  • Administrator rights for some protected logs.
  • Rust only if building from source.

Install

Download the latest release from:

https://github.com/Swatto86/EventSleuth/releases

Run the executable and select the logs you want to inspect.

First use

  1. Open EventSleuth.
  2. Select a log, such as Application, System, Security, or a custom provider log.
  3. Apply filters to reduce the result set.
  4. Select an event to inspect details.
  5. Export the filtered result set when you need to share or archive evidence.

Filtering

EventSleuth is built around narrowing noisy logs quickly.

Common filters include:

  • event level, such as Critical, Error, Warning, Information
  • provider/source
  • event ID
  • text search
  • time range
  • log channel

Use time filters first when investigating a known outage window. Then add provider or level filters to remove background noise.

Exporting

EventSleuth can export filtered results:

  • CSV for spreadsheets and ticket attachments
  • JSON for scripts and structured analysis

Export after filtering so the output contains the focused evidence set rather than an entire log dump.

Performance notes

The app is designed for large event sets: queries run away from the UI thread, result lists are virtualized, filtering is composable, and expensive work is delayed until needed.

For extremely large logs, start with a time range and level filter before widening the search.

Build from source

git clone https://github.com/Swatto86/EventSleuth.git
cd eventsleuth
cargo build --release
target\release\EventSleuth.exe

Run tests:

cargo test

Run with debug logging:

$env:RUST_LOG="debug"
cargo run

Troubleshooting

Access denied

Some logs require elevated rights. Re-run EventSleuth as Administrator or choose a log your account can read.

Empty event list

Check that the selected log contains events in the active time range and that filters are not excluding everything.

Slow queries

Use a narrower time range first, then add provider, level, or event ID filters.

  • GitHub: https://github.com/Swatto86/EventSleuth
  • Releases: https://github.com/Swatto86/EventSleuth/releases
← All tools