winevt

What it is and what it does

Winevt is a Python library that provides direct access to the Windows Event Logging system through the Windows API. Instead of parsing static event log files, it lets you query live event logs, subscribe to real-time events with callbacks, and work with event data as structured objects. The library abstracts Windows event concepts like providers, channels, and bookmarks, making it easier to filter events using XPath queries and traverse event properties programmatically.

The package is Windows-only and designed for system administrators and developers who need to monitor or audit Windows events from Python. It supports local and remote authentication, allows you to maintain your position in an event stream using bookmarks, and can handle multiple concurrent subscriptions. The library returns events as objects with both raw XML and structured property access, so you can work with event data however you prefer.

Use it for:

• Monitor system or application event logs in real-time and trigger alerts or actions when specific events occur.
• Audit security events (e.g., failed logins, privilege escalation) across local or remote Windows machines.
• Extract and filter historical events from event logs using XPath queries for compliance or forensic analysis.
• Build a centralized event collection system that subscribes to multiple Windows machines and aggregates events.
• Parse and analyze event log data programmatically without relying on the Windows Event Viewer GUI.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Winevt lets you query and subscribe to Windows Event Logs directly through the Windows API, and parse event log files programmatically from Python.

Yes, but with caution. The package does what it claims and has no known vulnerabilities, but it has not been actively maintained since 2017 and is marked dormant. Install it if you need direct Windows Event Log access from Python and are willing to accept that bug fixes or compatibility updates are unlikely. High install friction (compiled extension) and Windows-only support limit its audience. Not suitable for new projects requiring ongoing support.

Install

winevt on PyPI

pip install winevt

uv add winevt

poetry add winevt

Installing winevt

Before you install

High install friction: the package is a compiled extension with no runtime dependencies, but has not been updated since its initial release in 2017 and is marked dormant. Last commit was in 2024, but the codebase shows no active maintenance. Installation requires a working C compiler and Windows-specific build tools.

License in practice

MIT license is permissive; you can use this package in commercial and private projects with minimal restrictions, though you must include the license notice.

Quickstart

pip install winevt

from winevt import EventLog

query = EventLog.Query("Application", "Event/System/Provider[@Name='Windows Error Reporting']")
for event in query:
    print(event.System.Provider['Name'])

Windows-only; requires Python 3.2 or later (x64 recommended). Requires a C compiler and Windows SDK headers to build from source.

Verify before relying

• Whether the package works reliably on modern Windows versions (tested only on Windows 10 x64 with Python 3.6).
• Whether the package is compatible with Python versions beyond 3.6, given the dormant maintenance status.
• Whether pre-built wheels are available or if compilation is required on installation.

Package facts

Evidence: winevt-0.0.11.tar.gz

Keywords: windows, event, evt, evtx

Tags

More Monitoring packages