SwatLab ★ Star · 15 repos

Tools / EventSleuth

Analysis

EventSleuth

Read the signal, skip the noise.

Queries the Windows Event Log API on background threads and virtual-scrolls 100k+ events, so a busy channel filters to a narrow outage window without the MMC snap-in freezing.

↓ Download ★ Source on GitHub
Rustegui portable exe
01 How it works

Under the hood

Queries off the UI thread

Runs Windows Event Log API queries on background threads so the interface never blocks while a channel loads.

Virtual-scrolls the result set

Renders only the rows currently on screen, so 100,000+ events scroll smoothly instead of choking the UI.

Composable multi-criteria filters

Stacks level, provider, event ID, text, and time-range filters in memory without re-querying the log each time.

02 Requirements / install
Operating system
Windows
Distribution Single portable .exe — no installer, no admin rights required.
Dependencies None. Runs offline, zero telemetry.
Licence MIT · free forever

Event Viewer works, until it doesn’t — open a busy channel and the MMC snap-in freezes while it pumps a hundred thousand events through the UI thread. EventSleuth is the same data without the hang: it queries on a background thread, only renders the rows you can see, and lets you stack filters down to a narrow outage window.

What it does

  • Reads Windows Event Logs in a modern desktop UI.
  • Queries logs on background threads so the interface stays responsive.
  • Handles large result sets with virtual scrolling.
  • Filters by log, provider, level, event ID, text, and time range.
  • Exports filtered events to CSV or JSON.
  • Shows event details without opening modal dialog after modal dialog.

Requirements

  • Windows.
  • Permission to read the selected event logs.
  • Administrator rights for some protected logs.
  • Rust only if building from source.

Install

Download the latest release from:

https://github.com/Swatto86/EventSleuth/releases

Run the executable and select the logs you want to inspect.

First use

  1. Open EventSleuth.
  2. Select a log, such as Application, System, Security, or a custom provider log.
  3. Apply filters to reduce the result set.
  4. Select an event to inspect details.
  5. Export the filtered result set when you need to share or archive evidence.

Filtering

EventSleuth is built around narrowing noisy logs quickly.

Common filters include:

  • event level, such as Critical, Error, Warning, Information
  • provider/source
  • event ID
  • text search
  • time range
  • log channel

Use time filters first when investigating a known outage window. Then add provider or level filters to remove background noise.

Exporting

EventSleuth can export filtered results:

  • CSV for spreadsheets and ticket attachments
  • JSON for scripts and structured analysis

Export after filtering so the output contains the focused evidence set rather than an entire log dump.

Performance notes

The app is designed for large event sets: queries run away from the UI thread, result lists are virtualized, filtering is composable, and expensive work is delayed until needed.

For extremely large logs, start with a time range and level filter before widening the search.

Build from source

git clone https://github.com/Swatto86/EventSleuth.git
cd eventsleuth
cargo build --release
target\release\EventSleuth.exe

Run tests:

cargo test

Run with debug logging:

$env:RUST_LOG="debug"
cargo run

Troubleshooting

Access denied

Some logs require elevated rights. Re-run EventSleuth as Administrator or choose a log your account can read.

Empty event list

Check that the selected log contains events in the active time range and that filters are not excluding everything.

Slow queries

Use a narrower time range first, then add provider, level, or event ID filters.

  • GitHub: https://github.com/Swatto86/EventSleuth
  • Releases: https://github.com/Swatto86/EventSleuth/releases
← All tools