Clearing the Windows event log

pokeefe0001 · Oct 26, 2022

Is there anyway to clear out old event log records but leave recent ones ... where I get to define "recent"? I've got many thousands of records going back to March (when I installed Win11 maybe?). I see I can do a Save and Clear, but as near as I can tell that saves and clears everything.

Ghot · Oct 26, 2022

pokeefe0001 said:
Is there anyway to clear out old event log records but leave recent ones ... where I get to define "recent"? I've got many thousands of records going back to March (when I installed Win11 maybe?). I see I can do a Save and Clear, but as near as I can tell that saves and clears everything.

This is a pic from Win 10 but it should be the same or similar on Win 11...
You can "filter" what you're about to clear, by date, among other things...

1. On the left choose a log.
2. On the far right choose: Filter Current Log
3. Choose: Custom Range
4. Choose the dates.

Personally, I've found that just Clearing all of Event Viewer, then rebooting, works the best.

stormy13 · Oct 26, 2022

Clear All Event Logs in Event Viewer in Windows

How to Clear All Event Logs in Event Viewer in Windows

www.tenforums.com

Option one.

garlin · Oct 26, 2022

Using PowerShell (as Administrator), change the log retention policy to N days.

Code:

PS C:\Windows\system32> Get-EventLog -List

  Max(K) Retain OverflowAction        Entries Log
  ------ ------ --------------        ------- ---
  20,480      0 OverwriteAsNeeded           0 HardwareEvents
     512      7 OverwriteOlder              0 Internet Explorer
  20,480      0 OverwriteAsNeeded           0 Key Management Service
  20,480      0 OverwriteAsNeeded       1,527 Security
  20,480      0 OverwriteAsNeeded         786 System
  15,360      0 OverwriteAsNeeded          74 Windows PowerShell

PS C:\Windows\system32> Limit-EventLog -LogName System -OverflowAction OverwriteOlder -RetentionDays 14
PS C:\Windows\system32> Get-EventLog -List

  Max(K) Retain OverflowAction        Entries Log
  ------ ------ --------------        ------- ---
  20,480      0 OverwriteAsNeeded         548 Application
  20,480      0 OverwriteAsNeeded           0 HardwareEvents
     512      7 OverwriteOlder              0 Internet Explorer
  20,480      0 OverwriteAsNeeded           0 Key Management Service
  20,480      0 OverwriteAsNeeded       1,527 Security
  20,480     14 OverwriteOlder            787 System
  15,360      0 OverwriteAsNeeded          74 Windows PowerShell

pokeefe0001 · Oct 26, 2022

Ghot said:
This is a pic from Win 10 but it should be the same or similar on Win 11...
You can "filter" what you're about to clear, by date, among other things...

View attachment 43466

1. On the left choose a log.
2. On the far right choose: Filter Current Log
3. Choose: Custom Range
4. Choose the dates.

Personally, I've found that just Clearing all of Event Viewer, then rebooting, works the best.

Aha. Thanks! I never noticed the Clear button on the Filter display. (And I notice it does not say it clears just filtered records.) I'll give that a try.

I could clear all, but I'd rather keep the last month or two of event records. I never know when I'll want to get a recent historical trend.

Ghot · Oct 26, 2022

pokeefe0001 said:
Aha. Thanks! I never noticed the Clear button on the Filter display. (And I notice it does not say it clears just filtered records.) I'll give that a try.

I could clear all, but I'd rather keep the last month or two of event records. I never know when I'll want to get a recent historical trend.

Event Viewer since after Windows 7 anyhow... has gotten to be a bit of a drama queen.
Most of it is useless. That's why clearing the whole Event Viewer is not really a problem.
After 2-3 days and 2-3 reboots, you'll have all the "events" back again.

pokeefe0001 · Oct 26, 2022

There's an incredible amount of dross, but every once in a while useful information shows up.

Just today I noticed I've been getting NTFS event id 55 a couple of times a month for the past few months. I guess I have a bad flash memory drive. (I knew it was slow, but I guess it's sick.)

Ghot · Oct 26, 2022

pokeefe0001 said:
There's an incredible amount of dross, but every once in a while useful information shows up.

Just today I noticed I've been getting NTFS event id 55 a couple of times a month for the past few months. I guess I have a bad flash memory drive. (I knew it was slow, but I guess it's sick.)

You can check your flash memory drive with CrystalDiskInfo (free, portable).

The one in the .zip file, is the portable one...

Download

Open Source Software CrystalMark 3D25 A 3D (GLSL/WebGL) benchmaring software CrystalMark Retro A comprehensive benchmarking software that runs on Windows 95 or later. CrystalDiskInfo A storage health monitoring software CrystalDiskMark A simple storage benchmarking software [2026/03/31]...

crystalmark.info

pokeefe0001 · Dec 16, 2022

Ghot said:
This is a pic from Win 10 but it should be the same or similar on Win 11...
You can "filter" what you're about to clear, by date, among other things...

View attachment 43466

1. On the left choose a log.
2. On the far right choose: Filter Current Log
3. Choose: Custom Range
4. Choose the dates.

Personally, I've found that just Clearing all of Event Viewer, then rebooting, works the best.

I finally got around to trying this. It indeed allows me to filter the range of records I want to delete, but it looks like the filter is applied just to the display. Clear Log cleared the entire log - not what I wanted. I've restored the system from a couple days old backup and will try another technique.

I think I'll try @garlin's suggestion.

OAT · Dec 16, 2022

from the cmd as admin, this will clear them all out.

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1" <enter>

pokeefe0001 · Dec 16, 2022

OAT said:
from the cmd as admin, this will clear them all out.

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1" <enter>

I don't WANT to clear them all out. I want to clear out all records from the first records in the log (sometime last March) through the end of August.

garlin · Dec 16, 2022

There is no API to remove selected events from a log. If there was, it would be an obvious security hole for erasing your activity.
The only solution is to export all (or part) of an existing log, before clearing it.

For log retention, your options are set to unlimited, max days old, or max file size (where it deletes old events to make room).

pokeefe0001 · Dec 16, 2022

garlin said:
The only solution is to export all (or part) of an existing log, before clearing it.

Hmm. I suppose I would run into permission problems if I

exported part of a log (and optionally cleared it)
deleted C:\Windows\System32\winevt\Logs\<whatever>
copied the exported log to C:\Windows\System32\winevt\Logs\<whatever>

garlin said:
For log retention, your options are set to unlimited, max days old, or max file size (where it deletes old events to make room).

I tried changing the retention period but it seemed to do nothing. Does that just effect new records? Or does it not take effect until I clear the log?

I tried changing the max file size and got a popup saying it would not take effect until I cleared the log.

garlin · Dec 16, 2022

Copying over the log file doesn't work while the logger is still running. You would have to terminate it first.

What pop-up are we seeing? PS commands just take effect, there are no confirmation dialogs.

zbook · Dec 16, 2022

Another method to view event viewer recordings is to view them as text files.

The V2 log collector automatically creates text files of the event viewer records.

BSOD - Posting Instructions

BSOD - Posting Instructions This will show you how to help provide needed information about your system and dump files. It will not contain any personal or sensitive information about you or your data. To get better help with your Windows BSOD issue, please read these instructions and follow...

www.elevenforum.com

The text files can then be scanned from oldest to newest or newest to oldest.

If you want more detail on any text file you can return to the event viewer and use its filter.

Try3 · Dec 16, 2022

pokeefe0001 said:
Just today I noticed I've been getting NTFS event id 55 a couple of times a month for the past few months. I guess I have a bad flash memory drive. (I knew it was slow, but I guess it's sick.)

Naturally, it is up to you but doesn't that example make you realise that allowing older Event log entries to remain provides data for investigating faults that might have existed for some time before you notice their symptoms?

Not that I'm agreeing that

pokeefe0001 said:
getting NTFS event id 55

indicates that there is a fault to fix.

Do bear in mind that the Event logs exist for Windows' benefit not ours.
Event log entries might be recorded merely as triggers for other Windows processes to refer to and successful completion of those other processes might well not be reflected in an Event log entry that can be recognised as being related to the first [trigger] entry.
The existence of an entry in an Event log is not really a sufficient indicator that there is a problem worth using your time & effort to investigate.
Conversely, if you are investigating a problem for which there are fault symptoms, Event logs can provide data that might be helpful.

All the best,
Denis

pokeefe0001 · Dec 16, 2022

garlin said:
What pop-up are we seeing? PS commands just take effect, there are no confirmation dialogs.

I used the PS command to change the retention period, but I was able to change the file size via Properties in the context menu of the individual log files in Event Viewer. When I decreased the file size I got this display:

pokeefe0001 · Dec 16, 2022

Try3 said:
Naturally, it is up to you but doesn't that example make you realise that allowing older Event log entries to remain provide data for investigating faults that might have existed for some time before you noticed their symptoms?

Well, that's why I don't want to clear all records. I think saving 3 months worth of records should be enough, though. I really need 8 or 9 months of records.

garlin · Dec 17, 2022

There is no hard rule for keeping a specific set of months (unless you work in an organization that has a data retention policy).

The number of "normal" events can vary by function. For example, there are Setup logs which are only written when you do a clean install or in-place upgrade, and never written to again. Setup events can be years old, but take up virtually no space.

Other event classes can get swamped by unexpected errors (HW problems, or software bugs) which flood and overflow the default length.

You have to adjust based on growth. "Get-EventLog -List" in my posted example gives you a quick idea of how fast it changes. I believe the Properties setting on evtx files isn't allowed to truncate logs by itself, and warns you to take other steps. If the logger has been updated by PS, then it should self-truncate when a specific log exceeds the configured limits.

Clearing the Windows event log

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

"No need to be anybody but oneself"

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computers

My Computer

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computer