8

During some tests of a C# program that writes into the Event logs I accidentally created an event source "mysb" inside a event log named "mysb" instead of the "Application" event log.

Now I want to get rid of the mistakenly created event source but can't as it has the same name as the event log.

Is there any way to either eliminate source and event log mysb?

As it seems the names differ a bit (I took the names from how they are called from within C#): A source is ".Net Runtime", "Application Error", "Group Policy Files", ... While the protocol is "Application", "Security", ...

0

2 Answers 2

13

You can use the PowerShell command Remove-​Event​Log. According to the description on Microsoft docs:

The Remove-EventLog cmdlet deletes an event log file from a local or remote computer and unregisters all its event sources for the log. You can also use this cmdlet to unregister event sources without deleting any event logs.

(emphasis mine)

The syntax to remove an event log from the local computer is:

Remove-EventLog -LogName "MyLog"

Note: You must run this from an elevated Command Prompt.

1
  • Funny thing this doesn't always work. I find myself in a situation where I can still see the log after running Remove-EventLog and wevtutil el still lists it, and any further attempts to run Remove-EventLog yields an error. Apparently the log does not exist on the system even though I can clearly see it Dec 5, 2019 at 13:38
1

As @memory-of-a-dream noticed in the comment, if a log file doesn't exist, Remove-EventLog gives an error and can't remove this log.

In this case, there are two options:

Option 1

  1. Create an empty file on the path where the log is supposed to be. The path could be found in eventvwr.msc. Right button on the problematic log, choose Properties
  2. Restart Eventlog service. If it's not possible, restart the system
  3. Remove the log with Remove-EventLog. Successfully this time

Option 2

Remove registry key which describes the broken log:

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\<Bad Log Name>"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .