Log Lion turns raw logs into answers. It reads Windows Event Logs, ETW traces, firewall logs, web server logs, JSON and nearly any text format, and gives you the filtering, coloring, search and analysis tools to find what matters in millions of entries. SEE THE PATTERN BEFORE YOU SEARCH FOR IT Color is how Log Lion makes a log readable. Event Viewer and plain text editors give you row after row of the same gray text. Log Lion colors it for you, with nothing to set up. Syntax highlighting picks out numbers, quoted strings, name=value pairs, GUIDs and hex values inside every message, so the value you need stands out in a dense line. Color by any column and each distinct value gets its own color automatically: color by thread and interleaved work separates into strands; color by session or request ID and you can follow one transaction down the page while still seeing everything around it; color by level and a bad period is obvious the moment you scroll. Add highlight rules for the patterns you care about, several at once, each in its own color. Or color the matches of a filter instead of hiding everything else, so you never lose the context. The colors carry through when you copy or export to HTML and RTF, ready to paste into a ticket or report. WINDOWS, NATIVELY Log Lion was built on Windows, for Windows. Browse the live Application, System and Security event logs like a supercharged Event Viewer, or open .evtx files collected from another machine. Open legacy .evt files directly, including files left unclosed by a crash or power loss. Decode ETW event trace captures (.etl) from logman, wpr, xperf and Performance Monitor. Find Windows Defender Firewall logs automatically for each profile that has logging turned on. Capture system OutputDebugString output live, including from Windows services. FOR SECURITY AND FORENSICS Log Lion is read-only by design. Log contents aren't modified, so evidence stays intact. Filter a Security log to failed logons, color entries by account or source address, and watch the timeline show exactly when an attack started and stopped. Bookmark findings as you go, and export the relevant rows as HTML, RTF, CSV or XML for your report. FOR IT ADMINISTRATORS Follow growing logs on live servers with auto-refresh. Open IIS and other W3C web server logs, CSV and TSV exports, JSON Lines and compressed .zip and .gz files as they are. Read logs stored in SQL Server, PostgreSQL, MySQL, Oracle or SQLite over ODBC. Teach Log Lion a custom format once with the Import Text Log wizard and it recognizes it from then on. FOR DEVELOPERS Open JSON Lines, logfmt, HTTP Archive (.har) and MongoDB BSON files with their structure intact. Nested fields become columns, and times, severities and IDs are recognized automatically. Capture debug output as your code runs. Process every entry with a Lua script, or add your own log formats with the Extension SDK. FAST ON BIG FILES A multi-threaded engine parses, filters and searches in the background, so you can work with the first rows while the rest load. Narrow the range you are working on to make filters and searches faster still. FIND THE NEEDLE Write precise filters in a query language with a syntax-highlighting editor: word and phrase search, column comparisons, regular expressions, and AND/OR/NOT logic. Save filters and switch between them instantly. UNDERSTAND THE DATA The timeline shows entry volume over time, so bursts and gaps are obvious at a glance. Built-in analysis tools include a histogram, subtotals, column statistics, a profiler for begin and end event durations, a word counter, and an unmatched-pairs finder for requests that never got a response. Try Log Lion for free.