Solved Cannot remove an event source

lapetesson · Sep 23, 2023

During tests of a Windows 11 app writing into the Windows event log, I registered event source XXXYYYZZZ. I can list existing log entries in PowerShell:

Code:

PS C:\WINDOWS\system32> Get-EventLog -Source ZZZYYYXXX
cmdlet Get-EventLog at command pipeline position 1
Supply values for the following parameters:
LogName: Application
   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
   18312 sep 23 19:02  Information ZZZYYYXXX                       0 The description for Event ID '0' in Source 'ZZZ...
   18311 sep 23 19:01  Information ZZZYYYXXX                       0 The description for Event ID '0' in Source 'ZZZ...

However, when I'm trying to remove this event source, I get an error telling me that the source does not exist:

Code:

PS C:\WINDOWS\system32> Remove-EventLog -Source ZZZYYYXXX
Remove-EventLog : The source name "ZZZYYYXXX" does not exist on computer "localhost".
At line:1 char:1
+ Remove-EventLog -Source ZZZYYYXXX
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Remove-EventLog], InvalidOperationException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.RemoveEventLogCommand

I run PowerShell as an administrator. How do I remove an event source?

This event source is somehow "special" because I could delete another source using the same command.

garlin · Sep 23, 2023

Run "Get-EventLog -List" to verify if you actually created a new Event Log, or just a source to an existing Log.

"Remove-EventLog -Log" & "Remove-EventLog -Source" are two different cases.

lapetesson · Sep 24, 2023

In the question above, I've misinterpreted the results of PowerShell commands. The "Remove-EventLog -Source" command does remove the event source. But it does not remove the existing entries logged from this source. There are other ways to verify that this source is gone, e.g., in the Event Viewer or through listing children of the Event Log Application in the Registry.