Log Forensics - Free Online EVTX & Syslog Analyzer
Log Forensics
Load one or more log files - a Windows Event Log (.evtx), a syslog or auth.log/secure file, an Apache/nginx access or error log, or an IIS W3C log - to decode every event, merge them onto one unified timeline, and surface brute-force logins, password spraying, log tampering and audit-log clearing.
Drop one or more log files here
.evtx, syslog, auth.log, secure, access.log, error.log, or an IIS W3C log - or click to browse from your device
Choose log file(s)Overview
How many sources are loaded, how many events were decoded, and the findings this analysis produced across all of them.
Events
Every decoded event from every loaded source, normalized onto one shape and virtualized so even a very large log stays smooth to scroll.
--
| Time | Source | Host | Actor | Action | Severity | Details |
|---|
Timeline
Event volume over time across every loaded source, merged into one chronological view.
--
Sources
Every file loaded into this analysis, its detected format, and any parsing diagnostics from that specific source.
Anomalies
Brute-force bursts, password spraying, log clearing, time gaps, out-of-order timestamps, clock jumps and source diversity spikes detected across the unified timeline.
Filters
Narrow the Events tab by actor, source IP, Windows Event ID, severity or time range.
--
Strings
Readable text pulled directly from the raw file bytes of every loaded source, ASCII and UTF-16, independent of how each file was parsed.
--
Understanding Log Forensics
EVTX Is a Database, Not Text
A Windows Event Log is a binary container split into 64 KB chunks, each holding its own template table. Rather than repeating a full XML structure for every event, Windows defines a template once and every matching event supplies only the values that fill it in - this tool resolves those templates, including one defined in a different chunk than the event that uses it, and rebuilds the full event XML from the substitutions.
Logon Type Is the Whole Question
A successful logon (Event ID 4624) means very different things depending on its logon type: type 3 is a routine network connection, while type 10 is an interactive Remote Desktop session. This tool decodes that field automatically, and on a failed logon (4625) it also decodes the status code - distinguishing a wrong password from a login attempt against an account that does not exist at all.
Spraying Looks Nothing Like Brute Force
A classic brute force is many failed attempts against one account. Password spraying inverts that shape: a handful of attempts against many different accounts from a single source, specifically to stay under a per-account lockout threshold. A detector that only watches one account at a time misses spraying completely - this tool watches both shapes at once.
A Quiet Night Isn't a Gap
Flagging every silent stretch in a log as suspicious would make every quiet night a finding. Instead, this tool learns each source's own normal event rate and only flags a gap that is a large multiple of that baseline - a real tampering signal, not a false alarm from a system that was simply idle.
One Timeline, Every Source
Add a Windows Security.evtx export alongside a Linux auth.log from the same investigation and both appear together on one merged, chronologically sorted timeline - the point of this tool is correlating what happened across systems, not analyzing one log format in isolation. Event volume is capped at a generous ceiling per analysis so an extremely large log still stays responsive; the overview and report both state plainly when that cap was reached.
Key Takeaways
- A chunk with a bad checksum is still parsed and flagged, never skipped outright - partial evidence beats none.
- RFC 3164 syslog carries no year, so this tool infers one from context and says so explicitly.
- A collapsed "message repeated N times" line is expanded back out, or every downstream count built on it would be wrong.
-
An IIS log's own
#Fields:line is read, never assumed - its column order is self-describing. - Nothing leaves your device: every parse, decode and correlation runs client-side in your browser.