Windows only
LOG COUNT EVENT ID
LOG: Idle — Windows Event Log via wevtutil
Select a log and click LOAD.

Common Event IDs:
4624 — Successful logon
4625 — Failed logon
4688 — Process creation
4698 — Scheduled task created
7045 — New service installed
1102 — Audit log cleared