EventViewerX

High-performance Windows Event Log tooling for .NET and PowerShell.

PSEventViewer is the thin PowerShell surface. EventViewerX is the reusable C# engine underneath it. Live channels, remote sessions, WEC, provider messages, and Windows configuration use the Windows Event Log APIs. Saved EVTX files can also use an explicitly selected portable adapter.

In this project, offline means reading a saved .evtx file instead of an active channel. The default saved-file path still uses Windows Eventing APIs. EventViewerX.Evtx is an optional dependency-backed adapter for Linux, macOS, and Windows; it plugs into the core ISavedEventReader contract and therefore feeds the same typed projection, detection, reporting, and storage pipeline. The separate package exists because it adds the third-party evtx parser and its dependencies—there is no EventViewerX.Offline package.

Both portable adapters omit provider-formatted messages and support standard XPath 1.0 rather than every Windows Event Log XPath extension. The managed EvtxSavedEventReader requires no external executable, but remains opt-in because its current allocation cost misses the production performance gate. On a 31.5 MB Security fixture it preserved all 62,031 records and achieved 100% identity parity with Windows, but processed about 5,364 events/second with roughly 720 KB allocated/event versus 41,719 events/second and 3.5 KB/event for the Windows path. The fidelity gate also runs on Linux and reports header, chunk, recovery, and parser diagnostics explicitly.

The managed adapter also recognizes literal BinXML records produced by rendered WEC subscriptions and routes them through a bounded, spec-aligned EVX reader. It preserved all 653 records from the archived ForwardedEvents fidelity fixture with complete identity parity; the retained sanitized archive fixture exercises that path on Windows and Linux CI. EvtxDumpSavedEventReader remains an explicit alternate parser: it executes a caller-owned evtx_dump path, never downloads or updates the tool, and normalizes streaming JSONL into the same EVX contracts. Its timestamps are precise to one microsecond rather than the final 100-nanosecond FILETIME digit, and the retained truncated fixture is handled only by the managed adapter. Keep diagnostics enabled for either engine.

One project, one home

PSWinReporting began as an Active Directory event-reporting module. Its second generation, PSWinReportingV2, broadened that work, while PSEventViewer grew into the focused PowerShell module and reusable EventViewerX .NET engine used for modern Windows Event Log automation.

Those projects increasingly solved the same problems from different starting points. In August 2026, the PSWinReporting and PSWinReportingV2 lines were frozen and folded into the PSEventViewer/EventViewerX home. Their Git histories were preserved rather than copied as a source-only snapshot, and the former EvotecIT/PSWinReporting repository was renamed to EvotecIT/EventViewerX. The old PSWinReporting URL redirects here; the former PSEventViewer repository is now an archive that points here.

The names users install have not changed:

• PowerShell users continue to install PSEventViewer.
• .NET users continue to reference the EventViewerX packages.
• PSWinReporting and PSWinReportingV2 remain available as frozen packages for existing deployments, but new development belongs here.

The final frozen sources remain available on dedicated branches:

• PSWinReporting contains the final 1.x release, version 1.8.1.7.
• PSWinReportingV2 contains the final 2.x release, version 2.0.24.

The master branch is the active home of PSEventViewer and EventViewerX.

Why use it

• Stream local channels, remote channels, offline EVTX files, or structured QueryList XML without accumulating the complete result.
• Push event ID, provider, time, record ID, level, keyword, user, and event-data filtering into the Windows query engine.
• Choose exactly how much work each record needs: metadata, formatted message, structured payload, or the complete projection.
• Request deterministic provider messages such as en-US, with explicit fallback and render status.
• Query several hosts, channels, or files concurrently and merge results in a deterministic order with bounded memory.
• Export directly to CSV, JSON Lines, XML, or native EVTX without passing one PowerShell object per event through a file pipeline.
• Use native bookmarks, durable record checkpoints, subscriptions, watchers, provider and channel catalogs, classic log management, WEC subscription management, and both classic and manifest event writing.
• Query built-in typed event definitions and composite workflows such as failed logons, lockouts, group changes, Kerberos failures, AAD Connect health, IIS failures, and OS crashes.
• Evaluate versioned native detections and supported Sigma rules with bounded threshold, distinct-value, temporal, and ordered correlation state.
• Preserve finding evidence, rule provenance, source coverage, and three event clocks in reusable incident timelines. Short-window analysis needs no database; SQLite history is optional for restart-safe and long-lookback work.
• Turn the same normalized result into responsive HTML, an Excel workbook, or an email package without querying the event log again.

Install

Install-Module -Name PSEventViewer -Scope CurrentUser
Import-Module PSEventViewer

# Optional CLI for interactive use and automation on hosts with .NET 10.
dotnet tool install --global EventViewerX.Cli --version 4.0.0
evx --version

The module supports Windows PowerShell 5.1 and PowerShell 7+. EventViewerX targets .NET Framework 4.7.2, .NET 8 for Windows, and .NET 10 for Windows. The CLI is also available as RID-specific release ZIPs. Use a framework-dependent ZIP when .NET 10 is installed, or PortableCompat when the target host needs the runtime bundled with the executable.

Documentation

• Onboarding and prerequisites: local-first readiness, explicit Active Directory discovery, direct versus WEC collection, audit policy, permissions, firewall, and a complete scheduled daily AD-change report.
• PowerShell guide: local, remote, offline, large logs, export, checkpoints, watchers, administration, WEC, script recovery, and writes.
• EventViewerX .NET guide: typed synchronous and asynchronous reads, batching, subscriptions, exports, administration, and writes.
• Custom provider guide: PowerShell hashtables, JSON, typed C#, build/install, signing/trust, named writes, upgrades, repair, rollback, and removal.
• Custom event definitions: one portable typed schema shared by query, reports, watchers, WEC, C#, and evx.exe.
• Troubleshooting: performance, permissions, remoting, message resources, EVTX, checkpoints, and provider deployment.
• Security and ownership boundaries: remote credentials, pack trust, regex policy, sensitive reports, database encryption and backup, durable outbox state, portable parsers, and provider installation.
• Migrating to 4.0: replace legacy schedules safely, use presets, aggregation, persistent Group Policy context, and interpret completeness evidence.
• Roadmap: the 4.0 release gate, active contracts, and deliberately deferred product decisions.
• Documentation index, event query benchmark contract, and local history benchmark contract.

PowerShell quick start

## Fast system-field scan. No provider message or XML is materialized.
Get-EVXEvent -LogName Security -EventId 4624, 4625 `
    -TimePeriod Last24Hours -ReadMode Metadata -MaxEvents 1000

## Deterministic Englis