Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Windows 10 / How to Clear Windows Event Logs Using PowerShell or Wevtutil

November 24, 2017 Windows 10Windows Server 2012 R2

How to Clear Windows Event Logs Using PowerShell or Wevtutil

In some cases it is necessary to delete all entries from Windows event logs on a computer or a server. Of course, you can clear the system logs from the Event Viewer console GUI—  Eventvwr.msc (right-click the log you would like to clear and select Clear Log). However, starting with Vista, Windows has been using several dozens of logs for different system components, and it is time-consuming to manually clear all of them in the Event Viewer. It is much easier to clear logs from the command prompt: using PowerShell or the built-in console tool wevtutil.

Contents:
  • Clearing Event Logs With PowerShell
  • Clearing the Logs Using the console tool WevtUtil.exe

event viewer clear log from GUI

Clearing Event Logs With PowerShell

If you have PowerShell 3 installed (by default, it is installed in Windows 8 / Windows Server and higher), you can use Get-EventLog and Clear-EventLog cmdlets to get the list of event logs and clear them.

Start the PowerShell console with the administrator privileges and using the following command display the list of all standard event logs in the system with the maximum size and the number of events.

Get-EventLog –LogName *

Get-EventLog –LogName *

To clear all entries from the specific event log (for example, System log), use this command:

Clear-EventLog –LogName System

As a result, all events of this log will be deleted, and there will be only one event with the EventId 104 and the message “The System log file was cleared“.

Clear-EventLog –LogName System  The System log file was cleared

To clear all event logs, you have to redirect the log names to the pipeline, but unfortunately, it is forbidden. So, we will have to use the ForEach cycle:

Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }

Thus, all standard event logs will be cleared.

Clearing the Logs Using the console tool WevtUtil.exe

To work with the events, for a long time in Windows there have been a powerful command prompt utility WevtUtil.exe. Its syntax is a bit complicated for the first sight. Here, for example, that returns help of utilities:

WevtUtil.exe

To display the list of the logs registered in the system, run this command:

WevtUtil enum-logs
or its shorter version:

WevtUtil el

Quite an impressive list of logs will be displayed on the screen.

Note. You can count how many logs there are using the following command: WevtUtil el |Measure-Object. In my case there were 1,053 different logs in Windows 10.

WevtUtil el

You can get a detailed information on the specific log:

WevtUtil gl Setup

WevtUtil gl Setup - get a detailed information on the specific log

Here is how you clear the events in the specific log:

WevtUtil cl Setup

Before you clear the events, you can backup them by save to a file:

WevtUtil cl Setup /bu:SetupLog_Bak.evtx

To clear all logs at once, you can use Get-WinEvent PowerShell cmdlet to get all log objects and Wevtutil.exe to clear them:

Get-WinEvent -ListLog * -Force | % { Wevtutil.exe cl $_.LogName }

or

Wevtutil el | ForEach { wevtutil cl “$_”}

Note. In our example, I was not able to clear 3 logs due to the access error. It’s worth to try and clear them using the Event Viewer.

clear all logs at once

You can clear the logs using the standard command prompt as well:

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

0 comment
5
Facebook Twitter Google + Pinterest
previous post
The Requested Resource Is in Use: Cluster Disk Error in Windows Server 2012 R2
next post
Defending Windows Domain Against Mimikatz Attacks

Related Reading

Using Previous Command History in PowerShell Console

January 31, 2023

How to Install the PowerShell Active Directory Module...

January 31, 2023

Enable Internet Explorer (IE) Compatibility Mode in Microsoft...

January 27, 2023

How to Disable or Uninstall Internet Explorer (IE)...

January 26, 2023

How to Delete Old User Profiles in Windows?

January 25, 2023

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • PowerShell
  • VMWare
  • Hyper-V
  • Linux
  • MS Office

Recent Posts

  • Using Previous Command History in PowerShell Console

    January 31, 2023
  • How to Install the PowerShell Active Directory Module and Manage AD?

    January 31, 2023
  • Finding Duplicate E-mail (SMTP) Addresses in Exchange

    January 27, 2023
  • How to Delete Old User Profiles in Windows?

    January 25, 2023
  • How to Install Free VMware Hypervisor (ESXi)?

    January 24, 2023
  • How to Enable TLS 1.2 on Windows?

    January 18, 2023
  • Allow or Prevent Non-Admin Users from Reboot/Shutdown Windows

    January 17, 2023
  • Fix: Can’t Extend Volume in Windows

    January 12, 2023
  • Wi-Fi (Internet) Disconnects After Sleep or Hibernation on Windows 10/11

    January 11, 2023
  • Adding Trusted Root Certificates on Linux

    January 9, 2023

Follow us

woshub.com
  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Booting Windows 7 / 10 from GPT Disk on BIOS (non-UEFI) systems
  • Removable USB Flash Drive as Local HDD in Windows 10 / 7
  • How to increase KMS current count (count is insufficient)
  • Unable to Connect Windows 10 Shared Printer to Windows XP
  • Using the BitLocker Repair Tool to Recover Data on Encrypted Drive
  • Auto-Mount a VHD/VHDX File at Startup in Windows 10, 8.1
  • Error 0x80073CFA: Can’t Uninstall Apps using Remove-AppxPackage in Windows 10
Footer Logo

@2014 - 2023 - Windows OS Hub. All about operating systems for sysadmins


Back To Top