Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Windows 10 / How to Clear Windows Event Logs Using PowerShell or Wevtutil

November 24, 2017 Windows 10Windows Server 2012 R2

How to Clear Windows Event Logs Using PowerShell or Wevtutil

In some cases it is necessary to delete all entries from Windows event logs on a computer or a server. Of course, you can clear the system logs from the Event Viewer console GUI—  Eventvwr.msc (right-click the log you would like to clear and select Clear Log). However, starting with Vista, Windows has been using several dozens of logs for different system components, and it is time-consuming to manually clear all of them in the Event Viewer. It is much easier to clear logs from the command prompt: using PowerShell or the built-in console tool wevtutil.

Contents:
  • Clearing Event Logs With PowerShell
  • Clearing the Logs Using the console tool WevtUtil.exe

event viewer clear log from GUI

Clearing Event Logs With PowerShell

If you have PowerShell 3 installed (by default, it is installed in Windows 8 / Windows Server and higher), you can use Get-EventLog and Clear-EventLog cmdlets to get the list of event logs and clear them.

Start the PowerShell console with the administrator privileges and using the following command display the list of all standard event logs in the system with the maximum size and the number of events.

Get-EventLog –LogName *

Get-EventLog –LogName *

To clear all entries from the specific event log (for example, System log), use this command:

Clear-EventLog –LogName System

As a result, all events of this log will be deleted, and there will be only one event with the EventId 104 and the message “The System log file was cleared“.

Clear-EventLog –LogName System The System log file was cleared

To clear all event logs, you have to redirect the log names to the pipeline, but unfortunately, it is forbidden. So, we will have to use the ForEach cycle:

Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }

Thus, all standard event logs will be cleared.

Clearing the Logs Using the console tool WevtUtil.exe

To work with the events, for a long time in Windows there have been a powerful command prompt utility WevtUtil.exe. Its syntax is a bit complicated for the first sight. Here, for example, that returns help of utilities:

WevtUtil.exe

To display the list of the logs registered in the system, run this command:

WevtUtil enum-logs
or its shorter version:

WevtUtil el

Quite an impressive list of logs will be displayed on the screen.

Note. You can count how many logs there are using the following command: WevtUtil el |Measure-Object. In my case there were 1,053 different logs in Windows 10.

WevtUtil el

You can get a detailed information on the specific log:

WevtUtil gl Setup

WevtUtil gl Setup - get a detailed information on the specific log

Here is how you clear the events in the specific log:

WevtUtil cl Setup

Before you clear the events, you can backup them by save to a file:

WevtUtil cl Setup /bu:SetupLog_Bak.evtx

To clear all logs at once, you can use Get-WinEvent PowerShell cmdlet to get all log objects and Wevtutil.exe to clear them:

Get-WinEvent -ListLog * -Force | % { Wevtutil.exe cl $_.LogName }

or

Wevtutil el | ForEach { wevtutil cl “$_”}

Note. In our example, I was not able to clear 3 logs due to the access error. It’s worth to try and clear them using the Event Viewer.

clear all logs at once

You can clear the logs using the standard command prompt as well:

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

1 comment
5
Facebook Twitter Google + Pinterest
previous post
Windows 10: WSUS Error 0x8024401c
next post
How to Obtain SeDebugPrivilege when Debug Program Policy is Enabled

Related Reading

Recovering Files from BitLocker Encrypted Drive

June 1, 2023

Microsoft Key Management Service (KMS) Volume Activation FAQs

May 31, 2023

Configuring Event Viewer Log Size on Windows

May 24, 2023

How to Detect Who Changed the File/Folder NTFS...

May 24, 2023

How to Create, Change, and Remove Local Users...

May 17, 2023

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • PowerShell
  • VMWare
  • Hyper-V
  • Linux
  • MS Office

Recent Posts

  • Recovering Files from BitLocker Encrypted Drive

    June 1, 2023
  • Microsoft Key Management Service (KMS) Volume Activation FAQs

    May 31, 2023
  • Configuring Event Viewer Log Size on Windows

    May 24, 2023
  • How to Detect Who Changed the File/Folder NTFS Permissions on Windows?

    May 24, 2023
  • Enable Single Sign-On (SSO) Authentication on RDS Windows Server

    May 23, 2023
  • Allow Non-admin Users RDP Access to Windows Server

    May 22, 2023
  • How to Create, Change, and Remove Local Users or Groups with PowerShell?

    May 17, 2023
  • Fix: BSOD Error 0x0000007B (INACCESSABLE_BOOT_DEVICE) on Windows

    May 16, 2023
  • View Success and Failed Local Logon Attempts on Windows

    May 2, 2023
  • Fix: “Something Went Wrong” Error When Installing Teams

    May 2, 2023

Follow us

  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Booting Windows 7 / 10 from GPT Disk on BIOS (non-UEFI) systems
  • Removable USB Flash Drive as Local HDD in Windows 10 / 7
  • How to increase KMS current count (count is insufficient)
  • Unable to Connect Windows 10 Shared Printer to Windows XP
  • Error 0x80073CFA: Can’t Uninstall Apps using Remove-AppxPackage in Windows 10
  • Auto-Mount a VHD/VHDX File at Startup in Windows 10, 8.1
  • Limited Wi-Fi Access in Windows 10 and 8.1 – Troubleshooting
Footer Logo

@2014 - 2023 - Windows OS Hub. All about operating systems for sysadmins


Back To Top