I would like to clear the contents in the security event (security.evtx) using DOS commands in windows server 2003. I get an error: The file is being used by another process. Should I stop the event collection services? Does this service have any dependency before this service is stopped?

  • 2
    What is the command that you are using which gives you the error? – Vinayak Aug 20 '14 at 21:13
  • 2
    There is no DOS in Windows Server 2003. There is, however, a command prompt. – a CVn Aug 21 '14 at 11:54
  • I meant using del C:\Windows\System32\winevt\Logs\security.evtx on the command prompt. Can removal of logs file be as simple as this. When I try to do that, it gives me an error that the file is used by another program. Can be disable the event collection and then try to remove the contents from the log file? if so, what is the syntax in windows 2003. Do we need to disable another dependent files on event collection service? – dhomya Aug 23 '14 at 19:37

You can use PowerShell (you'll have to install it first): Clear-Eventlog -Log Security

Or you could try this instead: wevtutil clear-log Security

Source: https://serverfault.com/a/460863/218766

  • Can I use wevtutil in windows 2003? – dhomya Aug 21 '14 at 2:17
  • I think so. You can always try and see if you can – Vinayak Aug 21 '14 at 3:01
  • I was using del <filename> on c prompt. Could deletion of log files be as simple as that? However, this will always give an error that the file is being used by another program. Can we disable event logs service? – dhomya Aug 23 '14 at 19:45
  • I'd recommend you use wevtutil. Disabling the event logging service is a terrible idea. However, you may try this at your own peril – Vinayak Aug 23 '14 at 19:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.