Windows OS Hub
  • Windows Server
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Group Policies
  • Windows Clients
    • Windows 10
    • Windows 8
    • Windows 7
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
  • PowerShell
  • Exchange
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Group Policies
  • Windows Clients
    • Windows 10
    • Windows 8
    • Windows 7
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
  • PowerShell
  • Exchange

 Windows OS Hub / Windows 10 / How to Clear Windows Event Logs Using PowerShell or Wevtutil

November 24, 2017 Windows 10Windows Server 2012 R2

How to Clear Windows Event Logs Using PowerShell or Wevtutil

In some cases it is necessary to delete all entries from Windows event logs on a computer or a server. Of course, you can clear the system logs from the Event Viewer console GUI—  Eventvwr.msc (right-click the log you would like to clear and select Clear Log). However, starting with Vista, Windows has been using several dozens of logs for different system components, and it is time-consuming to manually clear all of them in the Event Viewer. It is much easier to clear logs from the command prompt: using PowerShell or the built-in console tool wevtutil.

Contents:
  • Clearing Event Logs With PowerShell
  • Clearing the Logs Using the console tool WevtUtil.exe

event viewer clear log from GUI

Clearing Event Logs With PowerShell

If you have PowerShell 3 installed (by default, it is installed in Windows 8 / Windows Server and higher), you can use Get-EventLog and Clear-EventLog cmdlets to get the list of event logs and clear them.

Start the PowerShell console with the administrator privileges and using the following command display the list of all standard event logs in the system with the maximum size and the number of events.

Get-EventLog –LogName *

Get-EventLog –LogName *

To clear all entries from the specific event log (for example, System log), use this command:

Clear-EventLog –LogName System

As a result, all events of this log will be deleted, and there will be only one event with the EventId 104 and the message “The System log file was cleared“.

Clear-EventLog –LogName System  The System log file was cleared

To clear all event logs, you have to redirect the log names to the pipeline, but unfortunately, it is forbidden. So, we will have to use the ForEach cycle:

Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }

Thus, all standard event logs will be cleared.

Clearing the Logs Using the console tool WevtUtil.exe

To work with the events, for a long time in Windows there have been a powerful command prompt utility WevtUtil.exe. Its syntax is a bit complicated for the first sight. Here, for example, that returns help of utilities:

WevtUtil.exe

To display the list of the logs registered in the system, run this command:

WevtUtil enum-logs
or its shorter version:

WevtUtil el

Quite an impressive list of logs will be displayed on the screen.

Note. You can count how many logs there are using the following command: WevtUtil el |Measure-Object. In my case there were 1,053 different logs in Windows 10.

WevtUtil el

You can get a detailed information on the specific log:

WevtUtil gl Setup

WevtUtil gl Setup - get a detailed information on the specific log

Here is how you clear the events in the specific log:

WevtUtil cl Setup

Before you clear the events, you can backup them by save to a file:

WevtUtil cl Setup /bu:SetupLog_Bak.evtx

To clear all logs at once, you can use Get-WinEvent PowerShell cmdlet to get all log objects and Wevtutil.exe to clear them:

Get-WinEvent -ListLog * -Force | % { Wevtutil.exe cl $_.LogName }

or

Wevtutil el | ForEach { wevtutil cl “$_”}

Note. In our example, I was not able to clear 3 logs due to the access error. It’s worth to try and clear them using the Event Viewer.

clear all logs at once

You can clear the logs using the standard command prompt as well:

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

0 comment
2
Facebook Twitter Google + Pinterest
previous post
The Requested Resource Is in Use: Cluster Disk Error in Windows Server 2012 R2
next post
Fix ‘Access Denied’ Error in Adobe Reader 11

Related Reading

How to Sign a PowerShell Script (PS1) with...

February 25, 2021

How to Shadow (Remote Control) a User’s RDP...

February 22, 2021

Configuring PowerShell Script Execution Policy

February 18, 2021

Configuring Proxy Settings on Windows Using Group Policy...

February 17, 2021

Updating Group Policy Settings on Windows Domain Computers

February 16, 2021

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange
  • Windows 10
  • Windows 8
  • Windows 7
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2008 R2
  • PowerShell
  • VMWare
  • MS Office

Recent Posts

  • Accessing USB Flash Drive from VMWare ESXi

    February 26, 2021
  • How to Sign a PowerShell Script (PS1) with a Code Signing Certificate?

    February 25, 2021
  • Change the Default Port Number (TCP/1433) for a MS SQL Server Instance

    February 24, 2021
  • How to Shadow (Remote Control) a User’s RDP session on RDS Windows Server 2016/2019?

    February 22, 2021
  • Configuring PowerShell Script Execution Policy

    February 18, 2021
  • Configuring Proxy Settings on Windows Using Group Policy Preferences

    February 17, 2021
  • Updating Group Policy Settings on Windows Domain Computers

    February 16, 2021
  • Managing Administrative Shares (Admin$, IPC$, C$, D$) in Windows 10

    February 11, 2021
  • Packet Monitor (PktMon) – Built-in Packet Sniffer in Windows 10

    February 10, 2021
  • Fixing “Winload.efi is Missing or Contains Errors” in Windows 10

    February 5, 2021

Follow us

woshub.com
  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Booting Windows 7 / 10 from GPT Disk on BIOS (non-UEFI) systems
  • Removable USB Flash Drive as Local HDD in Windows 10 / 7
  • How to Create a Wi-Fi Hotspot on your Windows 10 PC
  • How to increase KMS current count (count is insufficient)
  • How to Download APPX Installation File from Microsoft Store in Windows 10 / 8.1
  • How to Sign an Unsigned Driver for x64 Windows 10, 8.1 or 7 with a Self-signed Certificate
  • How to Hide Installed Programs from Programs and Features in Windows?
Footer Logo

@2014 - 2018 - Windows OS Hub. All about operating systems for sysadmins


Back To Top