EVTX Viewer | Open Windows Event Logs Online

EVTX viewer for Windows event log files on Mac, Linux or Windows. Filter by event ID, level and provider, read the XML, export CSV. Nothing is uploaded.

Also known as: evtx viewer · evtx viewer online · evtx file viewer · open evtx file on mac · evtx viewer linux · windows event log viewer online · evtx to csv · evtx to xml · evtx parser · security evtx analyzer

devops and infrastructure tools

ssl and security tools

viewers

Event Log File

Drop a .evtx file here, or click to browse

Up to 2 GB. Decoded in your browser 64 KB at a time, never uploaded.

On the Windows machine, logs live in C:\Windows\System32\winevt\Logs. Copy one out with wevtutil epl Security C:\Temp\Security.evtx from an elevated prompt.

Events

Every event in the log will appear here with its time, level, event ID and provider. Pick one to read its fields, decoded logon type and failure codes, and the full XML.

About EVTX Viewer

An EVTX viewer opens Windows event log files (.evtx) on a Mac, Linux or Windows computer without Event Viewer. Drop in Security.evtx, System.evtx or any Applications and Services log to filter events by ID, level and provider, read each event's fields and XML, decode logon types and failure codes, and export what you find to CSV or XML. The file is decoded in your browser and never uploaded.

Key Features

Reads Security, System, Application, Sysmon, PowerShell and every other .evtx log, including dirty logs copied from a running system and chunks carved from a disk image
Filters by level, provider and free text, and by event ID with Event Viewer's syntax: 4624, 4625 or 4720-4767, -4634
Names 150+ common event IDs and decodes logon types, NTSTATUS failure codes such as 0xC000006A and message codes such as %%2313
Shows each event's EventData fields and its full XML in the same layout as Event Viewer's XML view
Exports the filtered events to CSV (one row per event, EventData as JSON) or to a single XML file
Reports file damage instead of failing: dirty headers, checksum mismatches and records that cannot be decoded

Use Cases

Reviewing a Security.evtx a client emailed to your MSP help desk, on a MacBook with no Windows VM
Tracing a burst of 4625 failed logons from one IP address to the 4740 account lockout it caused
Pulling 4624, 4720 and 1102 events into a CSV as evidence for a SOC 2 or HIPAA access review
First-pass incident response: finding PowerShell 4104 script blocks, new 7045 services and 1102 log clears
Checking why a Windows server in AWS rebooted, from the 41, 1074 and 6008 events in its System log

Supported Formats

Windows XML Event Log (.evtx), Windows Vista and later

Dirty logs copied while Windows had them open

Forwarded Events logs from Windows Event Forwarding

Raw ElfChnk chunks carved from a disk image

Related Keywords

evtx viewer

evtx viewer online

evtx file viewer

open evtx file on mac

evtx viewer linux

windows event log viewer online

evtx to csv

evtx to xml

evtx parser

security evtx analyzer

How do I open an EVTX file on a Mac?

macOS and Linux have no Event Viewer, so the usual answers are a Windows virtual machine or a Python script such as python-evtx. You can drop the file on this page instead: it is decoded in your browser, so a log full of user names and IP addresses never leaves your Mac. To get a log off a Windows machine, run wevtutil epl Security C:\Temp\Security.evtx from an elevated command prompt, or use Save All Events As in Event Viewer. Event logs live in C:\Windows\System32\winevt\Logs.

Your event log never leaves this tab

The file is read 64 KB at a time and decoded in your browser. Nothing is uploaded, and auto-save keeps only the text summary (counts by event ID, level and provider), never the events themselves.

Liked this tool?

DevToolLab is free to use. If this viewer saved you some time today, please consider supporting our work.

Buy us a coffee ☕

Frequently asked questions

What is EVTX Viewer used for?

EVTX viewer for Windows event log files on Mac, Linux or Windows. Filter by event ID, level and provider, read the XML, export CSV. Nothing is uploaded.

Is EVTX Viewer free to use?

Yes. EVTX Viewer is completely free with no usage limits, and there is no paid tier required to use it.

Do I need an account to use EVTX Viewer?

No. EVTX Viewer works immediately in your browser with no signup, login, or email address required.

Related Tools

JSON Viewer Online | Explore JSON Tree Structure Free

View and explore JSON data in an interactive collapsible tree structure. Search, filter, and navigate nested objects and arrays. Free online JSON viewer with no signup required.

json tools

viewers

Swagger Viewer Online | Free OpenAPI Viewer

Swagger viewer and OpenAPI explorer online. Load a spec from a URL or paste JSON/YAML, browse endpoints and schemas, and send live test calls. Free.

json tools

api and http tools

CSV Viewer Online | CSV File Reader

CSV viewer online: open a CSV from a URL, upload a file, or paste data, then search, sort, and filter it in a clean table. Shareable ?url= links, custom delimiters, large files.

csv and spreadsheet tools

url and link tools

More Tools You Might Like

Pastebin Online | Share Code & Text Snippets Free

Popular

Share code snippets, logs, and text with a shareable link. Syntax highlighting for 30+ languages, expiration controls, and password protection for Pro users.

text tools

password and key generators

math calculators

utilities

Use Tool

URL Tracker & Link Shortener | Track Clicks

Popular

Create short, trackable URLs with detailed click analytics. Track visitor location, devices, referrers, and more. Password protection & QR codes included.

text tools

password and key generators

url and link tools

networking

Use Tool

Webhook Receiver & Inspector | Test HTTP Webhooks

Popular

Generate a unique URL to easily test, receive and inspect HTTP webhooks in real-time. View request headers, query parameters, JSON payloads, and more.