2

During some tests of a C# program that writes into the Event logs I accidentally created an event source "mysb" inside a event log named "mysb" instead of the "Application" event log.

Now I want to get rid of the mistakenly created event source but can't as it has the same name as the event log.

Is there any way to either eliminate source and event log mysb?

As it seems the names differ a bit (I took the names from how they are called from within C#): A source is ".Net Runtime", "Application Error", "Group Policy Files", ... While the protocol is "Application", "Security", ...

6

You can use the PowerShell command Remove-​Event​Log. According to the description on Microsoft docs:

The Remove-EventLog cmdlet deletes an event log file from a local or remote computer and unregisters all its event sources for the log. You can also use this cmdlet to unregister event sources without deleting any event logs.

(emphasis mine)

The syntax to remove an event log from the local computer is:

Remove-EventLog -LogName "MyLog"

Note: You must run this from an elevated Command Prompt.

| improve this answer | |
  • Funny thing this doesn't always work. I find myself in a situation where I can still see the log after running Remove-EventLog and wevtutil el still lists it, and any further attempts to run Remove-EventLog yields an error. Apparently the log does not exist on the system even though I can clearly see it – memory of a dream Dec 5 '19 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.