Evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files. It can process a high number of events quickly, making it suitable for use during investigations and hunting activities across a high number of collected events. Pau Lo asked on 8/26/2014. Software Microsoft Legacy OS Digital Forensics. 10 Comments 4 Solutions 8557 Views Last Modified: 9/1/2014. Is there any free GUI software that can view/search evtx files (event viewer files). SpectX is a log file analyzer that lets you view, parse, investigate and export Windows event logs and any text-based log files using your desktop computer. A powerful alternative to Windows Event Viewer, SpectX helps you conduct simple searches as well as complex queries and runs on Windows, OSX as well as Linux. Users who tried Event Log Explorer see it as a superior solution to Windows Event Viewer helping to boost their productivity twice. Event Log Explorer benefits. Instant access to event logs Event Log Explorer works with both local and remote event logs as well as with event log files in EVT and EVTX format. .evtx - Windows 7 Event Log. The EVTX data files are related to Microsoft Windows.EVTX file is a Windows 7 Event Log. The Event Log is a Windows service that logs about program, security, and system events occurring in Windows devices.
-->Windows Events provides a standard, centralized way for applications (and the operating system) to record important software and hardware events. The event-logging service stores events from various sources in a single collection called an event log. Prior to Windows Vista, you would use either Event Tracing for Windows (ETW) or Event Logging to log events. Windows Vista introduced a new eventing model that unifies both ETW and the Windows Event Log API.
The installer also writes entries into the event log. These record events such as following:
- Success or failure of the installation; removal or repair of a product.
- Errors that occur during product configuration.
- Detection of corrupted configuration data.
If a large amount of information is written, the Event Log file can become full and the installer displays the message, 'The Application log file is full.'
The installer may write the following entries in the event log. All event log messages have a unique event ID. All general errors authored in the Error table that are returned for an installation that fails are logged in the Application Event Log with a message ID equal to the Error + 10,000. For example, the error number in the Error table for an installation completed successfully is 1707. The successful installation is logged in the Application Event Log with a message ID of 11707 (1707 + 10,000).
Evtx Viewer For All
For information about how to enable verbose logging on a user's computer when troubleshooting deployment, see Windows Installer Best Practices.
| Event ID | Message | Remarks |
|---|---|---|
| 1001 | Detection of product '%1', feature '%2' failed during request for component '%3' | A warning message. For details, see Searching For a Broken Feature or Component. |
| 1002 | Unexpected or missing value (name: '%1', value: '%2') in key '%3' | Error message that there was an unexpected or missing value. |
| 1003 | Unexpected or missing subkey '%1' in key '%2' | Error message that there was an unexpected or missing subkey. |
| 1004 | Detection of product '%1', feature '%2', component '%3' failed Note: Beginning with Windows Installer version 2.0, this message is: Detection of product '%1', feature '%2', component '%3' failed. The resource '%4' does not exist. | A warning message. See also Searching For a Broken Feature or Component. |
| 1005 | Install operation initiated a reboot | Informational message that the installation initiated a reboot of the system. |
| 1006 | Verification of the digital signature for cabinet '%1' cannot be performed. WinVerifyTrust is not available on the computer. | Warning message. A cabinet was authored in the MsiDigitalSignature table to have a WinVerifyTrust check performed. This action could not be performed because the computer does not have the proper cryptography DLLs installed. |
| 1007 | The installation of %1 is not permitted by software restriction policy. The Windows Installer only allows execution of unrestricted items. The authorization level returned by software restriction policy was %2. | An error message indicating that the administrator has configured software restriction policy to disallow this install. |
| 1008 | The installation of %1 is not permitted due to an error in software restriction policy processing. The object cannot be trusted. | An error message indicating that there were problems attempting to verify the package according to software restriction policy. |
| 1012 | This version of Windows does not support deploying 64-bit packages. The script '%1' is for a 64-bit package. | Error message indicating that scripts for 64-bit packages can only be executed on a 64-bit computer. |
| 1013 | {Unhandled exception report} | Error message for an unhandled exception, this is the report. |
| 1014 | Windows Installer proxy information not registered correctly | Error message that proxy information was not registered correctly. |
| 1015 | Failed to connect to server. Error: %d | Informational message that the installation failed to connect to server. |
| 1016 | Detection of product '%1', feature '%2', component '%3' failed. The resource '%4' in a run-from-source component could not be located because no valid and accessible source could be found. | Warning message. For more information, see Searching for a Broken Feature or Component. |
| 1017 | User SID had changed from '%1' to '%2' but the managed app and the user data keys cannot be updated. Error = '%3'. | Error message indicating that an error occurred while attempting to update the user's registration after the user's SID changed. |
| 1018 | The application '%1' cannot be installed because it is not compatible with this version of Windows. | Error message indicating that the installation is incompatible with the currently running version of Windows. Contact the manufacturer of the software being installed for an update. |
| 1019 | Product: %1 - Update '%2' was successfully removed. | Informational message that the installer has removed the update.Windows Installer 2.0: Not available. |
| 1020 | Product: %1 - Update '%2' could not be removed. Error code %3. Additional information is available in the log file %4. | Error message indicating that the installer was unable to remove the update. Additional information is available in the log file.Windows Installer 2.0: Not available. |
| 1021 | Product: %1 - Update '%2' could not be removed. Error code %3. | Error message indicating that the installer was unable to remove the update. For information on how to turn on logging, see Enable verbose logging on user's computer when troubleshooting deployment.Windows Installer 2.0: Not available. |
| 1022 | Product: %1 - Update '%2' installed successfully. | Informational message that the installer has installed the update successfully. Windows Installer 2.0: Not available. |
| 1023 | Product: %1 - Update '%2' could not be installed. Error code %3. Additional information is available in the log file %4. | Error message indicating that the installer was unable to install the update. Additional information is available in the log file.Windows Installer 2.0: Not available. |
| 1024 | Product: %1 - Update '%2' could not be installed. Error code %3. | Error message indicating that the installer was unable to install the update. For information on how to turn logging on, see Enable verbose logging on user's computer when troubleshooting deployment.Windows Installer 2.0: Not available. |
| 1025 | Product: %1. The file %2 is being used by the following process: Name: %3 , Id %4. | Windows Installer 2.0: Not available. |
| 1026 | Windows Installer has determined that its configuration data registry key was not secured properly. The owner of the key must be either Local System or BuiltinAdministrators. The existing key will be deleted and re-created with the appropriate security settings. | Warning message.Windows Installer 3.1 and earlier: Not available. |
| 1027 | Windows Installer has determined that a registry sub key %1 within its configuration data was not secured properly. The owner of the key must be either Local System or BuiltinAdministrators. The existing sub key and all of its contents will be deleted. | Warning message.Windows Installer 3.1 and earlier: Not available. |
| 1028 | Windows Installer has determined that its configuration data cache folder was not secured properly. The owner of the key must be either Local System or BuiltinAdministrators. The existing folder will be deleted and re-created with the appropriate security settings. | Warning messageWindows Installer 3.1 and earlier: Not available. |
| 1029 | Product: %1. Restart required. | Warning message indicatiing that a system restart is required to complete the installation and the restart has been deferred to a later time.Windows Installer 3.1 and earlier: Not available. |
| 1030 | Product: %1. The application tried to install a more recent version of the protected Windows file %2. You may need to update your operating system for this application to work correctly. (Package Version: %3, Operating System Protected Version: %4). | Warning message indicating that the installation tried to replace a critical file that is protected by Windows Resource Protection. An update of the operating system may be required to use this application. Windows Installer 3.1 and earlier: Not available. |
| 1031 | Product: %1. The assembly '%2' for component '%3' is in use. | Warning message indicating that the installation tried to update an assembly currently in use. The system must be restarted to complete the update of this assembly.Windows Installer 3.1 and earlier: Not available. |
| 1032 | An error occurred while refreshing environment variables updated during the installation of '%1'. | Warning message indicating that some users who are logged on to the computer may need to log off and back on to complete the update of environment variables.Windows Installer 3.1 and earlier: Not available. |
| 1033 | Product: %1. Version: %2. Language: %3. Installation completed with status: %4. Manufacturer: %5. | Field 1 - ProductName Field 2 - ProductVersion Field 3 - ProductLanguage Windows Installer 3.1 and earlier: Not available. Field 5 - Manufacturer Windows Installer 4.5 and earlier: Field 5 not available. |
| 1034 | Product: %1. Version: %2. Language: %3. Removal completed with status: %4. Manufacturer: %5. | Field 1 - ProductName Field 2 - ProductVersion Field 3 - ProductLanguage Windows Installer 3.1 and earlier: Not available. Field 5 - Manufacturer Windows Installer 4.5 and earlier: Field 5 not available. |
| 1035 | Product: %1. Version: %2. Language: %3. Configuration change completed with status: %4. Manufacturer: %5. | Field 1 - ProductName Field 2 - ProductVersion Field 3 - ProductLanguage Field 5 - Manufacturer Windows Installer 4.5 and earlier: Field 5 not available. |
| 1036 | Product: %1. Version: %2. Language: %3. Update: %4. Update installation completed with status: %5. Manufacturer: %6. | Field 1 - ProductName Field 2 - ProductVersion Field 3 - ProductLanguage Field 4 - This is the user friendly name if the MsiPatchMetadata Table is present in the patch package. Otherwise, this is the patch code GUID of the patch. Field 5 - Status of update installation. Windows Installer 3.1 and earlier: Not available. Field 6 - Manufacturer Windows Installer 4.5 and earlier: Field 6 not available. |
| 1037 | Product: %1. Version: %2. Language: %3. Update: %4. Update removal completed with status: %5. Manufacturer: %6. | Field 1 - ProductName Field 2 - ProductVersion Field 3 - ProductLanguage Field 4 - This is the user friendly name if the MsiPatchMetadata Table is present in the patch package. Otherwise, this is the patch code GUID of the patch. Field 5 - Status of update removal. Windows Installer 3.1 and earlier: Not available. Field 6 - Manufacturer Windows Installer 4.5 and earlier: Field 6 not available. |
| 1038 | Product: %1. Version: %2. Language: %3. Reboot required. Reboot Type: %4. Reboot Reason: %5. Manufacturer: %6. | Field 1 - ProductName Field 2 - ProductVersion Field 3 - ProductLanguage
msirbRebootDeferred (2) - A user or admin has deferred a required restart of the computer using the UI or REBOOT=ReallySuppress.
msirbRebootInUseFilesReason (1)- A restart was required to replace files in use. msirbRebootScheduleRebootReason (2)- The package contains a ScheduleReboot action. msirbRebootForceRebootReason (3)- The package contains a ForceReboot action. msirbRebootCustomActionReason (4)- A custom action called the MsiSetMode function. Field 6 - Manufacturer Windows Installer 4.5 and earlier: Field 6 not available. |
| 10005 | The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is [1]. {{The arguments are: [2], [3], [4]}} | Error message indicating an internal error occurred. The text of this message is based upon the text authored for error 5 in the Error table. |
| 11707 | Product [2] – Installation operation completed successfully | Informational message that the installation of the product was successful. |
| 11708 | Product [2] – Installation operation failed | Error message that the installation of the product failed. |
| 11728 | Product [2] -- Configuration completed successfully. | Informational message that configuration of the product was successful. |
Evtx Viewer For Android
You can import localized errors strings for events into your database by using Msidb.exe or MsiDatabaseImport. The SDK includes localized resource strings for each of the languages listed in the Localizing the Error and ActionText Tables section. If the error strings corresponding to events are not populated, the installer loads localized strings for the language specified by the ProductLanguage property.