Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Under Windows 7 you open the Event Viewer to browse several categories. You can also clear a single category by clicking Clear Log... on the right pane.

Assuming I want to clear ALL categories, am I supposed to click and clear them one by one?
There are dozens of them. Is there a faster way? Maybe with PowerShell?

enter image description here enter image description here

share|improve this question
up vote 16 down vote accepted

Try WEvtUtil.exe

There's no way via the GUI to clear all logs at once. At least not that I've ever found. :)

Loop and delete with intermediate file

Here's a batch file that uses WEVTUTIL.exe to list the logs into a text file, and then use that text file to delete each of the logs.

WEVTUTIL EL > .\LOGLIST.TXT
for /f %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"
del .\LOGLIST.TXT
timeout 30

If you feel unsafe having this all in one batch file, then you can save this to two separate files and then run one after the other:
(The "Nuke" batch will just error out if it doesn't find a "loglist.txt" in its current directory.)

Populate-LogList.cmd

@ECHO OFF
REM Source: http://superuser.com/a/655185/389368
WEvtUtil.exe enum-logs > .\LOGLIST.TXT

Nuke-LogList.cmd

@ECHO OFF
REM Source: http://superuser.com/a/655185/389368
for /f %%a in ( .\LOGLIST.TXT ) do WEvtUtil.exe clear-log "%%a"
del .\LOGLIST.TXT
timeout 30

Loop and delete directly

As Logman pointed out in his answer, this can be further shortened down (and eliminate the need for the intermediate text file) by using something like (%'s double for batch file):

for /f %%a in ('WEVTUTIL EL') do WEVTUTIL CL "%%a"
timeout 30

Run as Admin!

Whichever way you choose, ensure you "Run As Administrator".

Easiest solution I've found. Been using it since Vista. :)

share|improve this answer
    
I was considering using WMI in a python script or similar - very good example of how batch can be an easier solution in certain scenarios. – Lyle Brown Oct 6 '13 at 18:50
    
CMD output + Event viewer overview. Used your second example via batch as admin. Some categories can't be cleared? Strange. And Powershell categorie still has 11.511 events? All others seem to be cleared – nixda Oct 6 '13 at 19:04
    
Screwed by a lack of quotes. sorry about that, fixed it. :) – Ƭᴇcʜιᴇ007 Oct 6 '13 at 19:08
    
Is it possible to use this solution or the proposed by @Logman in Windows XP? I don't see it has wevtutil in the system. – Sopalajo de Arrierez Apr 22 '14 at 10:39
1  
@SopalajodeArrierez "wevtutil" is only available from Vista and above... technet.microsoft.com/en-us/library/cc732848.aspx – Logman Apr 22 '14 at 12:50

Open cmd prompt or create batch script and "run as admin":

for /f %x in ('wevtutil el') do wevtutil cl "%x"

Powershell code for clearing all event logs:

wevtutil el | Foreach-Object {Write-Host "Clearing $_"; wevtutil cl "$_"}

or pick and choose in a script:

wevtutil.exe cl Analytic
wevtutil.exe cl Application
wevtutil.exe cl DirectShowFilterGraph
wevtutil.exe cl DirectShowPluginControl
wevtutil.exe cl EndpointMapper
wevtutil.exe cl ForwardedEvents
wevtutil.exe cl HardwareEvents
wevtutil.exe cl Internet Explorer
wevtutil.exe cl Key Management Service
wevtutil.exe cl MF_MediaFoundationDeviceProxy
wevtutil.exe cl "Media Center"
wevtutil.exe cl MediaFoundationDeviceProxy
wevtutil.exe cl MediaFoundationPerformance
wevtutil.exe cl MediaFoundationPipeline
wevtutil.exe cl MediaFoundationPlatform
wevtutil.exe cl Microsoft-IE/Diagnostic
wevtutil.exe cl Microsoft-IEFRAME/Diagnostic
wevtutil.exe cl Microsoft-PerfTrack-IEFRAME/Diagnostic
wevtutil.exe cl Microsoft-PerfTrack-MSHTML/Diagnostic

etc...

You can get a complete list of all event category names by typing the following in a cmd prompt or powershell:

wevtutil el

More information can be found at MS TechNet. Examples:

Export events from System log to C:\backup\system0506.evtx:

wevtutil epl System C:\backup\system0506.evtx

Clear all of the events from the Application log after saving them to C:\admin\backups\a10306.evtx:

wevtutil cl Application /bu:C:\admin\backups\a10306.evtx
share|improve this answer
    
Nice shortened version. – Ƭᴇcʜιᴇ007 Oct 6 '13 at 18:51
  • wevtutil is quite slow, specially when you clear all logs (including empty ones)

  • fastest solution I came up with:


ForEach ( $l in ( Get-WinEvent * ).LogName | sort | get-unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog("$l")}


Resul: "Cleared 16 events in 4 logs: 0.3684785 seconds"

Each part:

  • only gets logs containing events (there will be duplicate LogNames)

    ForEach ( $l in ( Get-WinEvent * ).LogName | sort | get-unique )

  • clear each one

    System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog( "$l" )

Full function:

function Clear-EventLogs
{
    Begin
    {
        $t1          = ( Measure-Command -Expression{ $active = ( Get-WinEvent ).LogName } ).TotalSeconds
        $totalEvents = $active.Count
        $active      = $active | Sort | Get-Unique
        $totalLogs   = $active.Count
    }
    Process
    {
        $t2 = ( Measure-Command -Expression{
            ForEach ( $l in $active )
            {
                [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog( "$l" )
                # ForEach-Object { Wevtutil.exe cl "$l" }
            }
        } ).TotalSeconds
    }
    End     { $t3 = $t1 + $t2; Write-Output "Cleared $totalEvents events in $totalLogs logs: $t3 seconds" }
}

If you see "Get-WinEvent : The data is invalid", you've hit the undocumented hard-limit of 256 logs. It may be necessary to filter the logs first. The following will select only the logs that have events (credit to http://www.powershellish.com/blog/2015/01/19/get-winevent-max-logs/ for the diagnosis ):

$logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName
ForEach ( $l in ( Get-WinEvent $logs ).LogName | sort | get-unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog("$l")}
share|improve this answer
1  
I retested this function. It took 271 seconds to wipe 168802 events – nixda Aug 27 '15 at 17:10
    
@nixda: 5 minutes for 169,000 events is not very fast, but I'm not sure how wevtutil would performs with the same number of events (it may also skip some of them) – paul bica Aug 27 '15 at 19:44

It is important to use the delim option if you have spaces in the names:

WEVTUTIL EL > .\LOGLIST.TXT
for /f "delims=" %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"

You can also easily disable all event logging without stopping the event log service:

for /f "delims=" %%a in ('WEVTUTIL EL') do WEVTUTIL SL "%%a" /e:false

Of course this will only disable actually installed software events, if you install a new software, it will have the logging enabled by default. But good thing you can leave the Task Scheduler running, so just do it every month ;-)

share|improve this answer
    
How can I revert your second command (with SL and /e:false)? Or how can I restore all my event log properties back to default? – PeterCo May 31 at 9:28

BTW, this clears all the Log files, which can (depending on previous settings) free up quite some space

WEVTUTIL EL > .\LOGLIST.TXT
for /f "delims=" %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"
del .\LOGLIST.TXT
timeout 10
share|improve this answer

I've used .bat files to make it a little bit easier to clear log files. Just picked the simple script here http://winaero.com/blog/how-to-clear-the-windows-event-log-from-the-command-line/

Copied from that link.

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo Event Logs have been cleared!
goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
echo You must run this script as an Administrator!
echo.
:theEnd
  1. Open Notepad and copy-paste the that text into it.

  2. Save it as a batch file and give it any name you want for example: ClEvtLog.bat or ClEvtLog.cmd.

  3. Run it with admin rights.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.