wevtail

Ldogg123·Ldogg123.wevtail

tail -f for Windows event logs.

wevtail follows Windows event log channels live (push-based, no polling) through the Win32 EvtSubscribe API — like tail -f, but for the event log. It supports following multiple channels at once, colorized or JSON-lines output, XPath filtering, .evtx file replay, and remote-host tailing.