microsoft/EventLogExpert v26.5.28.1003

v26.5.28.1003

Repository: microsoft/EventLogExpert

Tag: v26.5.28.1003

Published: 2026-05-28T16:57:25Z

Prerelease: yes

Release notes: All changes since the last stable release (v26.3.5.912).

Highlights

• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status badges in Settings. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banner system for upgrade progress, recoverable errors (with optional action buttons), and crash recovery — the banner sits above the error boundary so it's still visible if something goes wrong. "No events found" alerts are grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements, visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Database Tools is available from the Tools menu, with a tabbed modal and vertical tab strip for Create, Diff, Merge, Show, and Upgrade provider-database operations.
• Database Tools includes a live log view that streams operation output while long-running work is in progress.
• Database Tools uses an elevation-safe Win32 file picker for choosing database paths and output locations.
• Database tooling caches the elevation check and warns when EventDbTool starts without administrator rights.
• Light mode with a "Follow system" option; the title bar honors the OS theme.
• Drag-and-drop column reordering in the event table; column widths and order are remembered.
• Details pane height is remembered between sessions.
• XML is now always available without flipping a toggle. It's only generated when a filter actually needs it, so there's no performance cost when you don't use it.
• New menu bar with a consistent look, replacing the older Windows menu bar (right-click menus are simpler too).
• Improved keyboard navigation in the event table.
• The "Open by Log Name" picker now mirrors the folder structure you'd see in Event Viewer (MMC).
• Exported .evtx files with a LocaleMetaData folder are now fully supported.
• DbTool can read MTA provider files.
• More events display the correct severity (Information / Warning / Error / Critical / Verbose).
• More event types and variant types are recognized, so more events resolve to readable text.
• The title bar now shows the app name and version before any open log names.
• In-app release notes and Markdown content now render italics.

Database & Recovery

• New V4 provider database format with improved resolution coverage (merges in publishers that own a given channel).
• Imported databases get a clear status in the Settings modal: classified, not yet classified, unknown format, has backup, etc.
• Empty or unrecognized provider databases are set aside (quarantined) instead of breaking the resolver.
• Obsolete or unrecognized databases are rejected by EventDbTool commands with a clear message.
• V3 databases automatically upgrade to V4. Newly imported databases start out disabled — turn them on when you're ready.
• If an upgrade is interrupted (power loss, crash, etc.), the app detects the leftover marker file and offers a recovery dialog.
• Removing a database no longer deletes your own .bak backup files.
• If one entry in a batch import fails, the rest still go through — the failures are listed in the Settings modal.
• Toggling pre-release builds in Settings can now kick off a database upgrade right from the confirmation dialog.
• Opening a log waits for database classification to finish first, so resolution doesn't silently use the wrong data.

Banners & Alerts

• New app-wide banner area for upgrade progress, attention items, and recoverable errors.
• Error banners can include an action button (for example, a Reload button).
• The Reload button automatically gets keyboard focus when an error banner appears, so you can press Enter…