How to clear all Windows event log categories fast

Question

Under Windows 7 you open the Event Viewer to browse several categories. You can also clear a single category by clicking Clear Log... on the right pane.

Assuming I want to clear ALL categories, am I supposed to click and clear them one by one?
There are dozens of them. Is there a faster way? Maybe with PowerShell?

Answer 1

Try WEvtUtil.exe

There's no way via the GUI to clear all logs at once. At least not that I've ever found. :)

Loop and delete with intermediate file

Here's a batch file that uses WEVTUTIL.exe to list the logs into a text file, and then use that text file to delete each of the logs.

WEVTUTIL EL > .\LOGLIST.TXT
for /f %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"
del .\LOGLIST.TXT
timeout 30

If you feel unsafe having this all in one batch file, then you can save this to two separate files and then run one after the other:
(The "Nuke" batch will just error out if it doesn't find a "loglist.txt" in its current directory.)

Populate-LogList.cmd

@ECHO OFF
REM Source: https://superuser.com/a/655185/389368
WEvtUtil.exe enum-logs > .\LOGLIST.TXT

Nuke-LogList.cmd

@ECHO OFF
REM Source: https://superuser.com/a/655185/389368
for /f %%a in ( .\LOGLIST.TXT ) do WEvtUtil.exe clear-log "%%a"
del .\LOGLIST.TXT
timeout 30

Loop and delete directly

As Logman pointed out in his answer, this can be further shortened down (and eliminate the need for the intermediate text file) by using something like (%'s double for batch file):

for /f %%a in ('WEVTUTIL EL') do WEVTUTIL CL "%%a"
timeout 30

Run as Admin!

Whichever way you choose, ensure you "Run As Administrator".

Easiest solution I've found. Been using it since Vista. :)

Answer 2

Open cmd prompt or create batch script and "run as admin":

for /f %x in ('wevtutil el') do wevtutil cl "%x"

Powershell code for clearing all event logs:

wevtutil el | Foreach-Object {Write-Host "Clearing $_"; wevtutil cl "$_"}

or pick and choose in a script:

wevtutil.exe cl Analytic
wevtutil.exe cl Application
wevtutil.exe cl DirectShowFilterGraph
wevtutil.exe cl DirectShowPluginControl
wevtutil.exe cl EndpointMapper
wevtutil.exe cl ForwardedEvents
wevtutil.exe cl HardwareEvents
wevtutil.exe cl Internet Explorer
wevtutil.exe cl Key Management Service
wevtutil.exe cl MF_MediaFoundationDeviceProxy
wevtutil.exe cl "Media Center"
wevtutil.exe cl MediaFoundationDeviceProxy
wevtutil.exe cl MediaFoundationPerformance
wevtutil.exe cl MediaFoundationPipeline
wevtutil.exe cl MediaFoundationPlatform
wevtutil.exe cl Microsoft-IE/Diagnostic
wevtutil.exe cl Microsoft-IEFRAME/Diagnostic
wevtutil.exe cl Microsoft-PerfTrack-IEFRAME/Diagnostic
wevtutil.exe cl Microsoft-PerfTrack-MSHTML/Diagnostic

etc...

You can get a complete list of all event category names by typing the following in a cmd prompt or powershell:

wevtutil el

More information can be found at MS TechNet. Examples:

Export events from System log to C:\backup\system0506.evtx:

wevtutil epl System C:\backup\system0506.evtx

Clear all of the events from the Application log after saving them to C:\admin\backups\a10306.evtx:

wevtutil cl Application /bu:C:\admin\backups\a10306.evtx

Answer 3

• wevtutil is quite slow, specially when you clear all logs (including empty ones)

• fastest solution I came up with:

---

ForEach ( $l in ( Get-WinEvent * ).LogName | sort | get-unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog("$l")}

---

Resul: "Cleared 16 events in 4 logs: 0.3684785 seconds"

Each part:

• only gets logs containing events (there will be duplicate LogNames)

  ForEach ( $l in ( Get-WinEvent * ).LogName | sort | get-unique )

• clear each one

  System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog( "$l" )

Full function:

function Clear-EventLogs
{
    Begin
    {
        $t1          = ( Measure-Command -Expression{ $active = ( Get-WinEvent ).LogName } ).TotalSeconds
        $totalEvents = $active.Count
        $active      = $active | Sort | Get-Unique
        $totalLogs   = $active.Count
    }
    Process
    {
        $t2 = ( Measure-Command -Expression{
            ForEach ( $l in $active )
            {
                [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog( "$l" )
                # ForEach-Object { Wevtutil.exe cl "$l" }
            }
        } ).TotalSeconds
    }
    End     { $t3 = $t1 + $t2; Write-Output "Cleared $totalEvents events in $totalLogs logs: $t3 seconds" }
}

If you see "Get-WinEvent : The data is invalid", you've hit the undocumented hard-limit of 256 logs. It may be necessary to filter the logs first. The following will select only the logs that have events (credit to http://www.powershellish.com/blog/2015/01/19/get-winevent-max-logs/ for the diagnosis ):

$logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName
ForEach ( $l in ( Get-WinEvent $logs ).LogName | sort | get-unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog("$l")}

Answer 4

It is important to use the delim option if you have spaces in the names:

WEVTUTIL EL > .\LOGLIST.TXT
for /f "delims=" %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"

You can also easily disable all event logging without stopping the event log service:

for /f "delims=" %%a in ('WEVTUTIL EL') do WEVTUTIL SL "%%a" /e:false

Of course this will only disable actually installed software events, if you install a new software, it will have the logging enabled by default. But good thing you can leave the Task Scheduler running, so just do it every month ;-)

Answer 5

BTW, this clears all the Log files, which can (depending on previous settings) free up quite some space

WEVTUTIL EL > .\LOGLIST.TXT
for /f "delims=" %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"
del .\LOGLIST.TXT
timeout 10

Answer 6

I've used .bat files to make it a little bit easier to clear log files. Just picked the simple script here http://winaero.com/blog/how-to-clear-the-windows-event-log-from-the-command-line/

Copied from that link.

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo Event Logs have been cleared!
goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
echo You must run this script as an Administrator!
echo.
:theEnd

1. Open Notepad and copy-paste the that text into it.

2. Save it as a batch file and give it any name you want for example: ClEvtLog.bat or ClEvtLog.cmd.

3. Run it with admin rights.