microsoft / eventlogexpert Goto Github PK

View Code? Open in Web Editor NEW

38.0 7.0 12.0 1.67 MB

License: MIT License

C# 82.67% HTML 11.10% CSS 4.75% JavaScript 1.48%

eventlogexpert's Introduction

EventLogExpert

A Windows Event Log viewer for tech support and IT professionals.

Key features

Quickly load huge .evtx files. File -> Open and select multiple files, or just drag-and-drop them into the view. The tool will happily load multiple .evtx files concurrently.
View multiple .evtx files in an interleaved combined view and examine how events line up across multiple servers.
See event description previews right in the table without having to open each individual event.
Filter using friendly drop-downs, use Advanced Filter and enter a LINQ expression, or combine both.
Create an event database to view .evtx files on computers that don't have the same product installed. For example, view Exchange Server or SQL Server logs on a user workstation.
Can be used as a replacement for Event Viewer to view live event logs. Choose Continuously Update on the View menu and watch new events appear in real time.

For more information, check our docs.

Quick Start

Windows 10 or 11

Simply download the EventLogExpert*.msix file from the latest and run it: https://github.com/microsoft/EventLogExpert/releases/latest/.

Windows Server 2019 or 2022

Note: Auto-updates do not work on 2019.

Download the EventLogExpert*.msix.
Windows 2019 will also need the Microsoft.WindowsAppRuntime*.msix unless it was already installed by something else. You'll find this file in the release with the EventLogExpert*.msix.
Enable sideloading:

Set-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock -Name AllowAllTrustedApps -Value 1
Install the runtime with Add-AppxPackage. Example:

Add-AppxPackage $home\Downloads\Microsoft.WindowsAppRuntime.1.2.msix
Install EventLogExpert:

Add-AppxPackage $home\Downloads\EventLogExpert_23.5.19.1256_x64.msix

First time setup

Head over to our docs.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

eventlogexpert's People

Contributors

Stargazers

Watchers

Forkers

rizwan3d pepe57 shahab96ii 1daste091 homaerr

eventlogexpert's Issues

Ability to specify a share or other location to find event databases

Resize handler for details pane

Copy event not working

'Copy event' option is just pasting empty event structure

Log Name: xyz.evtx
Source:
Date:
Event ID:
Task Category:
Level:
Keywords:
User:
Computer:
Description:

Event Xml:

Ability to open server feature logs

For example, being able to open a Directory services log and seeing the description for the events.
Currently I can open such logs but the description is empty.

Ability to resolve replacement strings, I think most prominently seen in security events

I find these in security events 4624:
Logon Information:
Logon Type: 5
Restricted Admin Mode: -
Virtual Account: %%1843
Elevated Token: %%1842

Impersonation Level: %%1833

I'm not even sure there is a decent way to resolve these from saved events.

I can't open the live security eventlog to check whether this works there.

Allow to filter on time oldest and newest event to show

this is also an important item to filter, e.g. to restrict view to one OS boot.

Support deactivating provider databases

It can be useful to choose which provider databases are active. For example, when viewing logs from Windows 2019, the format of a 36874 event has three properties, but on Windows 11 it has only one property. If you have provider databases for both, we could choose the wrong one and show an event with too little info.

Activating only the databases for the product versions you're using makes proper event description generation more reliable by taking the decision out of the tool's hands.

Ability to review multiple offline evtx files at once in a timeline view

Ability to open multiple evtx in one single pane to understand timeline.
Ex: fail over cluster where you need to review multiple evtx from systems to see when fail over happened then understand what happened on the cluster, etc.

(one pane, making sure the machine name is one of the columns to note which evtx/machine the event came from)

Refactor check for updates code to use latest release tag

Add an option to "Opt in to pre release" in the settings menu if we decide to use the pre release channel
Add an option under "Tools" menu to manually check for updates

Please add disable filter option and clear all filters option

Please add enable/disable filter(sub filter) per filter option.
Also Clear all filters option will be make program easy to use.

Crash due to circular reference

Event properties can have account information with circular references. This causes a crash when we attempt to write to the debug log.

2023-05-22T12:18:30.4408684-05:00 System.Text.Json.JsonException: A possible object cycle was detected. This can either be due to a cycle or if the object depth is larger than the maximum allowed depth of 64. Consider using ReferenceHandler.Preserve on JsonSerializerOptions to support cycles. Path: $.NewEvent.Properties.Value.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.AccountDomainSid.BinaryLength.
...
   at System.Text.Json.Serialization.JsonConverter`1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.Metadata.JsonPropertyInfo`1.GetMemberAndWriteJson(Object obj, WriteStack& state, Utf8JsonWriter writer)
   at System.Text.Json.Serialization.Converters.ObjectDefaultConverter`1.OnTryWrite(Utf8JsonWriter writer, T value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.Converters.IEnumerableDefaultConverter`2.OnWriteResume(Utf8JsonWriter writer, TCollection value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonCollectionConverter`2.OnTryWrite(Utf8JsonWriter writer, TCollection value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.Metadata.JsonPropertyInfo`1.GetMemberAndWriteJson(Object obj, WriteStack& state, Utf8JsonWriter writer)
   at System.Text.Json.Serialization.Converters.ObjectDefaultConverter`1.OnTryWrite(Utf8JsonWriter writer, T value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.Metadata.JsonPropertyInfo`1.GetMemberAndWriteJson(Object obj, WriteStack& state, Utf8JsonWriter writer)
   at System.Text.Json.Serialization.Converters.ObjectDefaultConverter`1.OnTryWrite(Utf8JsonWriter writer, T value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.WriteCore(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.WriteCoreAsObject(Utf8JsonWriter writer, Object value, JsonSerializerOptions options, WriteStack& state)
   at System.Text.Json.JsonSerializer.WriteCore[TValue](Utf8JsonWriter writer, TValue& value, JsonTypeInfo`1 jsonTypeInfo)
   at System.Text.Json.JsonSerializer.WriteString[TValue](TValue& value, JsonTypeInfo`1 jsonTypeInfo)
   at EventLogExpert.Store.LoggingMiddleware.BeforeDispatch(Object action)
   at Fluxor.Store.ExecuteMiddlewareBeforeDispatch(Object actionAboutToBeDispatched) in C:\Data\Mine\Code\Fluxor\Source\Lib\Fluxor\Store.cs:line 247
   at Fluxor.Store.DequeueActions() in C:\Data\Mine\Code\Fluxor\Source\Lib\Fluxor\Store.cs:line 287
   at Fluxor.Store.ActionDispatched(Object sender, ActionDispatchedEventArgs e) in C:\Data\Mine\Code\Fluxor\Source\Lib\Fluxor\Store.cs:line 173
   at Fluxor.Dispatcher.Dispatch(Object action) in C:\Data\Mine\Code\Fluxor\Source\Lib\Fluxor\Dispatcher.cs:line 51
   at EventLogExpert.Store.EventLog.LiveLogWatcher.<StartWatching>b__9_0(Object watcher, EventRecordWrittenEventArgs eventArgs)
   at System.Diagnostics.Eventing.Reader.EventLogWatcher.HandleEventsRequestCompletion()
   at System.Diagnostics.Eventing.Reader.EventLogWatcher.RequestEvents()
   at System.Diagnostics.Eventing.Reader.EventLogWatcher.SubscribedEventsAvailableCallback(Object state, Boolean timedOut)
   at System.Threading._ThreadPoolWaitOrTimerCallback.WaitOrTimerCallback_Context_f(Object state)

Create a Help toolbar menu

About window to display currently installed version and check for update button
Feedback option that directs to GitHub issues
Docs option that directs to documentation

Ability to specify time zone

Features needed for initial beta

Dynamic filter inputs

Filter select boxes should be switched to text input boxes that filter the selectable values as you type

Can't use mouse wheel to scroll source list (may also apply to other filter items)

When you add a filter per source and you drop down the list:
https://microsofteur-my.sharepoint.com/:i:/g/personal/herbertm_microsoft_com/Eff0zFh-Km1JtyePE3MHJSsBBwXJSEqNRBle6B1iBTrQZw?e=WPQjdq

You can’t just scroll with the mouse wheel. This closes the drop-down.

Ability to review multiple offline evtx files at once, side by side, etc

Ability to have multiple evtx open from different systems (or same) to look for differences. Reviewing good vs bad, etc.

Ability to allow 'Copy' option to have a '1 line output' option

(from previous version feedback shared with Bill, to have this tracked on this new version as well)

When working with multiple evtx files, filtering and sharing analysis with customers, it is useful to be able to copy & paste 1/multiple events in a ‘1 line’ type of output format , like this

Information 06/10/2022 11:31:11 Microsoft-Windows-Shell-Core 28019 (28179) AppResolver Cache Committed.
Information 06/10/2022 11:31:11 Microsoft-Windows-Shell-Core 28018 (28177) AppResolver Scan Stopped.

EventLogExpert would allow to multiple select and copy and the output is extended table type of

LogName: Microsoft-Windows-Shell-Core/Operational
Source: Microsoft-Windows-Shell-Core
Date: 10/6/2022, 11:31:11 AM
Event ID: 28019
Task Category: Shell32_AppResolver_CacheCommitted
Level: Information
User: yzx
Computer: xyz
Description:
AppResolver Cache Committed.

LogName: Microsoft-Windows-Shell-Core/Operational
Source: Microsoft-Windows-Shell-Core
Date: 10/6/2022, 11:31:11 AM
Event ID: 28018
Task Category: Shell32_AppResolver_Scan
Level: Information
User: yz
Computer: xyz
Description:
AppResolver Scan Stopped.

Live logging constantly resets date filter

When viewing a live log, new events constantly reset the date filter in the UI, even if a specific date has been chosen and applied.

It also makes it hard to choose a time since the time keeps resetting while the dialog is open.

Ability to save a filter "profile"

Ability to save filter profile so that it can be imported. This allows for creation of profiles for troubleshooting different issues that you can load.

Right click context menu to Include/Exclude selected item in filter

Context menu would give the option to Include > Level/Source/EventId/Task or maybe context based on current column with option to Include/Exclude that value

Optionally show XML event description

Set hotkey for copying event to clipboard

Ctrl-C on an Event does nothing. It should copy the event text to the clipboard.
EvPro has summary and full copy, and also cumulative event copy. These are not this high priority...

Multiple filters are always using "AND" operator, too inflexible

This is not working well for a number of reasons.
EvPro used implicit OR in each category, e.g. source, category, Event ID included and excluded.

Either do this or allow to specify the logic operator and support bracketing. I'm aware this adds a lot of work in the UI.

Enable filtering by Begin Date and End Date

Allow filters to be disabled

While not in edit mode, "Remove" option becomes "Disable"

Suggestions for Settings

I suggest having:

define what fields to copy when you copy an event. I would for example default to excluding "Log Name"
Setting to open new files (File/Open, double-click, drag&drop) in new window.
Color filtering configuration, including saving and loading it.
pre-defined Filter list, including saving and loading it.

Tasks

Beta Give feedback

Create custom copy behavior with option to choose fields #282

enhancement
Modal for grouping filters, allowing groups to be added/exported/imported together #283

enhancement
Options

EventLogExpert should associate itself with .evtx files

EventLogExpert should be associated with .evtx files
Double-clicking such a file should open a new ELE window with that file in it.

Security logs has option for keyword filtering

When you open a security event log in event viewer
There is an option to filter on keywords and only show audit failed events.

This is very useful for logon failures because we only care about the failure events. The same event id can be used for success or failure

I can't figure out how to filter on audit failures

EVTX does not load in Eventlog Expert, loads

I have an application eventlog I hapened to use for Eventlog Expert testing, and it does not load.

It loads fine and I can filter it in EvPro and in-box event viewer.

the first time I tried there was a note in the status line that it failed to load. In subsequent attempt it does nothing.

ODB link: https://microsofteur-my.sharepoint.com/:f:/g/personal/herbertm_microsoft_com/EuwlJpCKCTZFqEZ-t7Qv2OcB-qf77dmtuOBA08LdhFg74Q?e=mcMijR

Add function to "Add filter" section for selecting multiple event sources or events in same filter object

Please Add function to "Add filter" section to selecting multiple event sources for same filtering with checkboxes in same filter object instead adding sub filters one by one. . 0.9.15 version has checkboxes for Event Sources and Event IDs so you can select multiple options together to filter.
In this edition it will be excellent value if you use 0.9.15's filter frame expanding from top as "Advanced filter" section or adding checkboxes to combo boxes listing event sources and IDs.

If possible, change Reboot Required pop up to say something else.

If we could make this say "Application Restart Required" instead of "Reboot required"

Create and export providers from Tools menu

Netlogon Source events not showing description

I'm not sure when this stopped working. Oldest Netlogon event says:
Description not found. No provider available.

Resolver fails after enabling databases

After enabling several databases that were disabled, and then answering Yes to the prompt to reload all open logs, the resolver died:

2023-06-05T15:50:30.1741003-05:00 31 EventProviderDatabaseEventResolver was instantiated at:
   at System.Environment.get_StackTrace()
   at EventLogExpert.Library.EventResolvers.EventProviderDatabaseEventResolver..ctor(IDatabaseCollectionProvider dbCollection, Action`1 tracer)
   at EventLogExpert.Library.EventResolvers.VersatileEventResolver..ctor(IDatabaseCollectionProvider dbCollection, ITraceLogger tracer)
   at ResolveService(ILEmitResolverBuilderRuntimeContext, ServiceProviderEngineScope)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(Type serviceType, ServiceProviderEngineScope serviceProviderEngineScope)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetService[T](IServiceProvider provider)
   at EventLogExpert.Store.EventLog.EventLogEffects.<>c__DisplayClass4_0.<HandleOpenLogAction>b__0()
   at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot, Thread threadPoolThread)
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading.PortableThreadPool.WorkerThread.WorkerThreadStart()
2023-06-05T15:50:30.1742317-05:00 31 LoadDatabases was called with 5 databasePaths.
2023-06-05T15:50:30.1742703-05:00 31   C:\Users\bilong\AppData\Local\Packages\eventlogexpert_8wekyb3d8bbwe\LocalState\Databases\Exchange 2019.db
2023-06-05T15:50:30.1742883-05:00 31   C:\Users\bilong\AppData\Local\Packages\eventlogexpert_8wekyb3d8bbwe\LocalState\Databases\Exchange 2016.db
2023-06-05T15:50:30.1743058-05:00 31   C:\Users\bilong\AppData\Local\Packages\eventlogexpert_8wekyb3d8bbwe\LocalState\Databases\Windows 2019.db
2023-06-05T15:50:30.1743414-05:00 31   C:\Users\bilong\AppData\Local\Packages\eventlogexpert_8wekyb3d8bbwe\LocalState\Databases\Windows 2016.db
2023-06-05T15:50:30.1743685-05:00 31   C:\Users\bilong\AppData\Local\Packages\eventlogexpert_8wekyb3d8bbwe\LocalState\Databases\Windows 2012R2.db
2023-06-05T15:50:30.2102690-05:00 29 System.IO.FileNotFoundException: Could not load file or assembly 'Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60'. The system cannot find the file specified.
File name: 'Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60'
   at Microsoft.EntityFrameworkCore.Infrastructure.EntityFrameworkServicesBuilder.TryAddCoreServices()
   at Microsoft.EntityFrameworkCore.Internal.ServiceProviderCache.ApplyServices(IDbContextOptions options, ServiceCollection services)
2023-06-05T15:50:30.2105793-05:00 30 System.IO.FileNotFoundException: Could not load file or assembly 'Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60'. The system cannot find the file specified.
File name: 'Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60'
   at Microsoft.EntityFrameworkCore.Infrastructure.EntityFrameworkServicesBuilder.TryAddCoreServices()
   at Microsoft.EntityFrameworkCore.Internal.ServiceProviderCache.ApplyServices(IDbContextOptions options, ServiceCollection services)
2023-06-05T15:50:30.2108675-05:00 31 System.IO.FileNotFoundException: Could not load file or assembly 'Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60'. The system cannot find the file specified.
File name: 'Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60'
   at Microsoft.EntityFrameworkCore.Infrastructure.EntityFrameworkServicesBuilder.TryAddCoreServices()
   at Microsoft.EntityFrameworkCore.Internal.ServiceProviderCache.ApplyServices(IDbContextOptions options, ServiceCollection services)
2023-06-05T15:50:30.2111004-05:00 16 System.IO.FileNotFoundException: Could not load file or assembly 'Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60'. The system cannot find the file specified.
File name: 'Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60'
   at Microsoft.EntityFrameworkCore.Infrastructure.EntityFrameworkServicesBuilder.TryAddCoreServices()
   at Microsoft.EntityFrameworkCore.Internal.ServiceProviderCache.ApplyServices(IDbContextOptions options, ServiceCollection services)
2023-06-05T15:50:30.2127126-05:00 31 Action: EventLogExpert.Store.StatusBar.StatusBarAction+SetResolverStatus {"ResolverStatus":"System.Func\u00601[System.Type]: Could not load file or assembly \u0027Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60\u0027. The system cannot find the file specified."}
2023-06-05T15:50:30.2140250-05:00 16 Action: EventLogExpert.Store.StatusBar.StatusBarAction+SetResolverStatus {"ResolverStatus":"System.Func\u00601[System.Type]: Could not load file or assembly \u0027Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60\u0027. The system cannot find the file specified."}
2023-06-05T15:50:30.2143968-05:00 29 Action: EventLogExpert.Store.StatusBar.StatusBarAction+SetResolverStatus {"ResolverStatus":"System.Func\u00601[System.Type]: Could not load file or assembly \u0027Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60\u0027. The system cannot find the file specified."}
2023-06-05T15:50:30.2147511-05:00 30 Action: EventLogExpert.Store.StatusBar.StatusBarAction+SetResolverStatus {"ResolverStatus":"System.Func\u00601[System.Type]: Could not load file or assembly \u0027Microsoft.Extensions.Caching.Abstractions, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60\u0027. The system cannot find the file specified."}

Needs a unique icon

We're just a generic .NET icon at the moment. We need a new icon.

Auto update implementation

Deadlock when EventLogWatcher is disabled

When we reach the maximum number of new events, currently set at 5000, we attempt to set EventLogWatcher.Enabled to false. That puts us in this call stack on the UI thread:

 	System.Private.CoreLib.dll!System.Threading.WaitHandle.WaitOneNoCheck(int millisecondsTimeout) Line 139	C#
>	System.Diagnostics.EventLog.dll!System.Diagnostics.Eventing.Reader.EventLogWatcher.StopSubscribing() Line 120	C#
 	EventLogExpert.dll!EventLogExpert.Store.EventLog.EventLogReducers.ReduceAddEvent(EventLogExpert.Store.EventLog.EventLogState state, EventLogExpert.Store.EventLog.EventLogAction.AddEvent action)	Unknown
 	Fluxor.dll!Fluxor.Feature<EventLogExpert.Store.EventLog.EventLogState>.ReceiveDispatchNotificationFromStore(object action) Line 123	C#
 	Fluxor.dll!Fluxor.Store.DequeueActions() Line 290	C#
 	Fluxor.dll!Fluxor.Store.ActionDispatched(object sender, Fluxor.ActionDispatchedEventArgs e) Line 171	C#
 	Fluxor.dll!Fluxor.Dispatcher.Dispatch(object action) Line 47	C#

This wait is an attempt to wait until any other callbacks have finished. However, if another callback has fired, it can't finish, because fluxor already has the state locked on the UI thread:

 	[Waiting on lock owned by Thread 23388, double-click or press enter to switch to thread]	
 	[Managed to Native Transition]	
>	Fluxor.dll!Fluxor.Dispatcher.Dispatch(object action) Line 46	C#
 	System.Diagnostics.EventLog.dll!System.Diagnostics.Eventing.Reader.EventLogWatcher.HandleEventsRequestCompletion() Line 277	C#
 	System.Diagnostics.EventLog.dll!System.Diagnostics.Eventing.Reader.EventLogWatcher.RequestEvents() Line 258	C#
 	System.Diagnostics.EventLog.dll!System.Diagnostics.Eventing.Reader.EventLogWatcher.SubscribedEventsAvailableCallback(object state, bool timedOut) Line 217	C#

And thus we have a deadlock. Neither thread will proceed.

Needs Drag&Drop support. Dropping a EVTX opens the file in a new window

Having to go through dialogs is not good, I have an explorer view with the files open most of the time.

Feature Request: Load multiple Event logs for two scenarios

2 scenarios:
-Loading multiple logs from same source (May not need a Source computer column)
-Loading multiple logs from different sources. (Would def need a Source computer column)

Importing providers requires a restart

After importing new providers, EventLogExpert will not use the new databases until it is restarted.

Either we should call this out to the user, or we should make the change take effect without a restart of the tool.

Add XML filtering to the basic filter

Cache recent filters

We should cache the last 5 or 10 filters and provide a menu to allow the user to quickly switch between recent filters.

Selected event should be highlighted in the table

When an event is selected for display in the bottom pane, the event row should be highlighted in the table above.

The arrow keys should move the selected event up or down.

Easy way to copy event description to clipboard with XML

Create docs

Not sure if we need a full docs system or if we can get away with a big readme.md or another markdown file.

Regardless, we need some docs somewhere.

Feature Request: Easy XML Filtering

No one knows XPath. So, offer a text box where engineer can paste in what they care about, without having to learn XPath.
Scenario:
I need to know from this Security Log where TicketEncryptionType is equal to 0x17. I have the below XML:

[email protected]
contoso.COM
etype
S-1-5-21-Stuff
0x40810000
0x17
::ffff:A.B.C.D
62460
0x0
{A644847E-D66F-589F-E458-528DC8D5443B}
-

In the filter text box, I just put this in:

0x17

And then eventlog expert figures out the XML filter for me, and even offers the XPath query text. Also, include ability to and/or things, and add * for wildcards (if XPath supports that)

Add ability for color rules/color coding

Add the ability highlight certain items colors.
For example: color code RED for system shutdown/restart events and then color code BLUE for PNP events leading up to it, etc.

Similar as notepad++ or TAT tool for highlighting strings or items.

Opening same log twice causes crash

2023-06-05T15:44:21.7603700-05:00 1 System.ArgumentException: An element with the same key but a different value already exists. Key: 'D:\Application.evtx'
   at System.Collections.Immutable.ImmutableDictionary`2.HashBucket.Add(TKey key, TValue value, IEqualityComparer`1 keyOnlyComparer, IEqualityComparer`1 valueComparer, KeyCollisionBehavior behavior, OperationResult& result)
   at System.Collections.Immutable.ImmutableDictionary`2.Add(TKey key, TValue value, KeyCollisionBehavior behavior, MutationInput origin)
   at System.Collections.Immutable.ImmutableDictionary`2.Add(TKey key, TValue value)
   at EventLogExpert.Store.EventLog.EventLogReducers.ReduceOpenLog(EventLogState state, OpenLog action)
   at Fluxor.Feature`1.ReceiveDispatchNotificationFromStore(Object action) in C:\Data\Mine\Code\Fluxor\Source\Lib\Fluxor\Feature.cs:line 127
   at Fluxor.Store.DequeueActions() in C:\Data\Mine\Code\Fluxor\Source\Lib\Fluxor\Store.cs:line 306
   at Fluxor.Store.ActionDispatched(Object sender, ActionDispatchedEventArgs e) in C:\Data\Mine\Code\Fluxor\Source\Lib\Fluxor\Store.cs:line 176
   at Fluxor.Dispatcher.Dispatch(Object action) in C:\Data\Mine\Code\Fluxor\Source\Lib\Fluxor\Dispatcher.cs:line 51
   at EventLogExpert.MainPage.AddFile_Clicked(Object sender, EventArgs e)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()

Ability to sort 'Date and Time' ascend / descend

Please consider allowing changing 'Date and Time' ability to sort from current option (desc, newer events top) to asc (older events top) . This helps when sharing long analysis with customers, for easier presentation of sequences of events, from older to newer.