I would like to clear the contents in the security event (security.evtx) using DOS commands in windows server 2003. I get an error: The file is being used by another process. Should I stop the event collection services? Does this service have any dependency before this service is stopped?
-
2What is the command that you are using which gives you the error?– VinayakAug 20, 2014 at 21:13
-
2There is no DOS in Windows Server 2003. There is, however, a command prompt.– userAug 21, 2014 at 11:54
-
I meant using del C:\Windows\System32\winevt\Logs\security.evtx on the command prompt. Can removal of logs file be as simple as this. When I try to do that, it gives me an error that the file is used by another program. Can be disable the event collection and then try to remove the contents from the log file? if so, what is the syntax in windows 2003. Do we need to disable another dependent files on event collection service?– dhomyaAug 23, 2014 at 19:37
Add a comment
|
1 Answer
You can use PowerShell (you'll have to install it first):
Clear-Eventlog -Log Security
Or you could try this instead:
wevtutil clear-log Security
-
-
-
I was using del <filename> on c prompt. Could deletion of log files be as simple as that? However, this will always give an error that the file is being used by another program. Can we disable event logs service?– dhomyaAug 23, 2014 at 19:45
-
I'd recommend you use
wevtutil
. Disabling the event logging service is a terrible idea. However, you may try this at your own peril– VinayakAug 23, 2014 at 19:52