Event Log Triage support
Support is by email. Every question is answered in writing.
Before writing, the user guide and the common problems below answer most questions.
What to include in a bug report
- Your Windows version. Press Windows+R, type
winverand press Enter. Copy the version and build numbers from the window that opens. - What you did. The steps that led to the problem, and what kind of source you were reading: a saved
.evtxfile, a live channel on your computer, or a remote computer. - What the status bar said. The exact text at the bottom of the window, for example "Could not read" and the reason after it.
- The crash log, if the app closed on its own. It is at
%LOCALAPPDATA%\EventLogTriage\crash.log. Paste%LOCALAPPDATA%\EventLogTriageinto the File Explorer address bar to open the folder, and attach the file. It holds only the error and a stack trace from the app, and the app never sends it anywhere. If the file is not there, say so in your email.
Refunds
Event Log Triage is sold through the Microsoft Store, so Microsoft handles refunds, not the seller. To ask for one:
- Sign in at account.microsoft.com with the account you bought the app with.
- Open Order history.
- Find Event Log Triage and choose Request a refund.
Microsoft decides on the request under its own refund policy.
Common problems
A remote computer says access denied, or will not connect
The status bar shows "Could not read" with the message from Windows. The cause is almost always on the remote computer or the network, not in the app. Check these on the remote computer:
- The account you connect with (your own Windows account, or the user name you typed in Add remote machine) is a member of the Event Log Readers or Administrators group there.
- The Remote Event Log Management firewall rules are enabled. Run this once from an elevated command prompt on the remote computer:
netsh advfirewall firewall set rule group="Remote Event Log Management" new enable=yes - Your computer can reach it by name, and RPC (TCP 135 plus dynamic ports) gets through. If
ping namefails, the app will too. - On a domain, your domain account needs no extra step. A workgroup computer usually needs a user name and password typed into Add remote machine.
Not an error: if a third-party product is installed only on the remote computer, its events show raw event data instead of a written message. Descriptions come from the provider information on your own computer, and the Fields tab says so.
An .evtx file will not open
- The file is locked or incomplete. Another program has it open, or it was exported while still being written. Copy the file and open the copy, or export it again. The active logs in
C:\Windows\System32\winevt\Logsare held open by Windows; use Add live channel to read those instead. - The file is truncated or damaged. An interrupted copy or download leaves a damaged file. The status bar shows "Could not read" and the reason. When only some records are damaged, the app loads the rest and the status bar adds "N unreadable".
If a fresh copy still fails, write to support with the exact status bar text.
The app will not start, or closes on its own
- The app needs Windows 10 version 1809 (build 17763) or later, or Windows 11, on an x64 (64-bit Intel or AMD) PC. Run
winverto check. - It depends on the Windows App Runtime, which the Microsoft Store installs with the app. If it was removed, reinstall the app from the Store.
- Smart App Control or company policy on a managed PC can block an app from running. Your IT team is the one to ask about that.
If none of these explain it, email your Windows version and the crash log, as described under what to include in a bug report.
Large files use a lot of memory
The app reads every event into memory, at roughly 1.5 KB per event. 500,000 events need about a gigabyte, so a file with several million events can use more memory than the computer has free.
To work with a very large log, make it smaller first: filter it by channel or time and export just that part, or split it into several smaller exports. Event Viewer can do this with Filter Current Log, then Save Filtered Log File As. Inside the app, narrow by time first, then by level.
The Security log will not open as a live channel
An ordinary user can read Application, System and most operational channels. The Security channel and some others need more rights: run Event Log Triage as administrator, or ask your administrator to add your account to the Event Log Readers group.
Does the app send anything over the network?
Nothing to us. There is no telemetry, no analytics, no crash reporting service, no update check, no account and no advertising. The app uses the network for two things only: a remote event log connection you add yourself, which goes directly from your computer to that computer, and requests to the Microsoft Store, through Windows, to check the trial or full licence and to show the Store's own purchase and rating dialogs. Credentials you type stay in memory for that connection only. The privacy policy has the full detail.
Can it follow a log live, or send alerts?
No. There is no live tail; re-add the channel to refresh it. The app is for reading what is already in the logs, not for monitoring or alerting. Feature requests are welcome by email, without a promised date.
Get Event Log Triage
Free 7-day trial, then a one-time purchase: $9.99 on the Microsoft Store.