Home / server / Questions / 460862
Accepted
Ivan
Asked: 2012-12-26 14:14:19 +0800 CST

How to clear Windows event logs using command line?

  • 772

Normally I can open the Computer Management console, go to the Event Viewer snap-in, open the Windows Logs folder, right-click on Application/Security/Setup/System subfolder, choose Clear Log and confirm by pressing the Clear or Save and Clear button.

Having enough rights, how can I achieve the same effect through using command line, while raising no confirmation requests?

windows

5 Answers

  1. Best Answer

    Powershell.

    PS C:\>Clear-Eventlog -Log Application, System

    The default is not to prompt you, but you can supply the -Confirm switch if you want to be prompted.

    Edit:

    Get-WinEvent -ListLog Application,Setup,Security -Force | % { Wevtutil.exe cl $_.Logname }

    As per the comments, that should get both Operational and Administrative logs.

    • 14

  2. wevtutil enum-logs will enumerate all logs in the system while wevtutil clear-log will clear the logs. For your case it would be:

    wevtutil clear-log Application
wevtutil clear-log Security
wevtutil clear-log Setup
wevtutil clear-log System

    You can also backup while clearing with wevtutil clear-log System /backup:backup.evtx

    • 8

  3. For the case you want to clear all logs:

    for /f %x in ('wevtutil el') do wevtutil cl "%x"

    Extracted from here.

    • 2

  4. The following PowerShell clears all the event logs on the local machine, including the operational/debug/setup logs programmatically (without instantiating the "wevtutil" process). To clear just one log, modify the code accordingly. It's not perfect, however, sometimes the Debug logs are held open by something, and this does not generate any errors.

    $EventLogs=Get-WinEvent -Force -ListLog *
$EventSession=new-object System.Diagnostics.Eventing.Reader.EventLogSession
foreach ($Log in $EventLogs) {
  if ($Log.IsEnabled) {
    if ($Log.RecordCount -gt 0) { 
      if ($Log.LogType -eq "Debug") {
        $Log.IsEnabled=$false
        $Log.SaveChanges()
        $EventSession.ClearLog($Log.LogName)
        $Log.IsEnabled=$true
        $Log.SaveChanges()
      }
      else { $EventSession.ClearLog($Log.LogName) }
  }
}
    • 2

  5. this is how to clear all event log through powershell, make sure you're running it as administrator

    wevtutil el | Foreach-Object {wevtutil cl "$_"}

    • 0