Can I open an EVTX file on a Mac?

Yes. macOS has no built-in viewer for Windows event logs, but a browser-based viewer like this one or a command-line parser such as evtx_dump reads the file directly. No Windows virtual machine is required.

How do I open an EVTX file on Linux?

Open it in this browser-based viewer, or use evtx_dump or python-evtx from a terminal. All three parse the binary format natively on Linux.

Will I see the same message text as Event Viewer?

You see every structured field of each event. The friendly message sentence is rendered on Windows from provider DLLs that are not part of the .evtx, so no macOS or Linux tool can reproduce it exactly.

Is it safe to open sensitive logs in a browser?

With this viewer, yes: the file is parsed inside your browser tab and never sent anywhere. You can disconnect from the network after the page loads to confirm it.

Open EVTX files on Mac and Linux

Event Viewer only exists on Windows, but .evtx files often end up on a Mac or a Linux analysis box. The quickest option is this browser-based EVTX viewer: it runs in Safari, Chrome or Firefox on any OS, parses the file locally with WebAssembly and never uploads it.

Open the EVTX viewer ↗

Your options on macOS and Linux

In the browser (no install)

Drop the .evtx on the EVTX parser homepage. You get a searchable table, an Event ID breakdown, a timeline, built-in detections and CSV, TXT, JSON or XML export. It works the same on macOS, Linux and ChromeOS.

evtx_dump (Rust CLI)

The fastest command-line parser, with prebuilt macOS and Linux binaries. Outputs XML, JSON or JSON Lines.

evtx_dump -o jsonl Security.evtx | jq 'select(.Event.System.EventID == 4624)'

python-evtx

A pure-Python library and script, handy inside notebooks and existing Python tooling. Slower than the Rust parser on large logs.

pip install python-evtx
evtx_dump.py Security.evtx > security.xml

Chainsaw or Hayabusa

Cross-platform hunting tools that run Sigma rules over a folder of .evtx files. Use them when you want detections across many logs rather than to browse one.

How to open an EVTX file on a Mac

1
Copy the .evtx off the Windows hostLogs live in C:\Windows\System32\winevt\Logs. Copy the files you need (Security.evtx, System.evtx…) or export them from Event Viewer with Save All Events As.
2
Open EVTX parser in your browserSafari, Chrome and Firefox all work. The parser loads once and then runs offline.
3
Drop the file and exploreDrag the .evtx onto the page. Filter by Event ID, user or time, open any event's raw XML, and export what you need.

EVTX on Mac and Linux FAQ

Can I open an EVTX file on a Mac?: Yes. macOS has no built-in viewer for Windows event logs, but a browser-based viewer like this one or a command-line parser such as evtx_dump reads the file directly. No Windows virtual machine is required.
How do I open an EVTX file on Linux?: Open it in this browser-based viewer, or use evtx_dump or python-evtx from a terminal. All three parse the binary format natively on Linux.
Will I see the same message text as Event Viewer?: You see every structured field of each event. The friendly message sentence is rendered on Windows from provider DLLs that are not part of the .evtx, so no macOS or Linux tool can reproduce it exactly.
Is it safe to open sensitive logs in a browser?: With this viewer, yes: the file is parsed inside your browser tab and never sent anywhere. You can disconnect from the network after the page loads to confirm it.