Event log cleanup

[bigkid]

here's a slick little command line that will clear all those event log records ... from a command shell run as administrator type or paste the following command

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"


let me know how you like it

 

[sminlal]

You can also right-click on the log file name in Event Viewer and select "Properties" - this gives you the option to:

- clear the log
- set the maximum log size (which indirectly controls how many messages the log will hold)
- choose whether to overwrite old events or archive them

 

[bigkid]

You can also right-click on the log file name in Event Viewer and select "Properties" - this gives you the option to:

- clear the log
- set the maximum log size (which indirectly controls how many messages the log will hold)
- choose whether to overwrite old events or archive them

Yeah but there are dozens of log files and it takes forever to clear them by 'clicking' each one .... that command line deletes all event log records (dozens of em) in one swoop

 

[jaddorf]

here's a slick little command line that will clear all those event log records ... from a command shell run as administrator type or paste the following command

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"


let me know how you like it

Hi. In Win7x64, when I try the above cmdline I get "in was unexpected at this time".

What variable should be supplied to give %1 a value?


Thanks/jim

 

[ricno]

Yeah but there are dozens of log files and it takes forever to clear them by 'clicking' each one .... that command line deletes all event log records (dozens of em) in one swoop

It is not dozens, it is actually over 400 event viewer log files. Why would you actually want to clear all of these?

Count with: wevtutil el | find /c /v ""

Hi. In Win7x64, when I try the above cmdline I get "in was unexpected at this time".

What variable should be supplied to give %1 a value?

It does not seem to work. If you replace %1 with %%a it would work in a batch file. Here is an example.

@ECHO OFF
for /F "tokens=*" %%a in ('wevtutil.exe el') DO ECHO wevtutil.exe cl "%%a"


Note that this has an ECHO on the actual cleaning part, so it will only display what it should run. If you really want to remove all these logs then clear the ECHO.

 

[jaddorf]

Hi. Thanks for your reply. I ended up with:

@for /f %%i in ( 'wevtutil el' ) do wevtutil cl "%%i" >NUL 2>&1


...which seems to work great.


Thanks again! /jim

 

[sminlal]

I'm still a little confused as to why you'd want to manually clean up the event logs when you can set them to automatically delete entries once the file reaches a certain size...

 

[bigkid]

are you sure this doesn't work for you

====> for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1" <====

copy and paste into cmd shell (everything inside arrows) just as is , (run as admin)

.....

by deleting these entries you get rid of all that ' old busy info ' that seems confusing, to me anyway...
and as you tune your system sometimes the old warnings dont apply anymore

 

[Hawkeye22]

by deleting these entries you get rid of all that ' old busy info ' that seems confusing, to me anyway...
and as you tune your system sometimes the old warnings dont apply anymore

You do know you can filter them and even create custom views, right? I'd rather set the size limit smaller and have it delete old entries than do a mass kill of event log entries.

 

[bigkid]

yeah a size limit a size limit will overwriteif thats what you prefer hawk...
i have custom views motoring start and shutdown time.....i start in about 23ms and down in about 6ms and it buggs me that a warning keeps getting thrown for theis , i think, good performance --- also windows defender always throws an err when i shutdown - that it has stopped working unexpectedly -- really buggs me --- also there are other warn and err msgs that i think are totally useless and bogus

 

[peterdru401]

For Windows event log clean up you can use a third party tool as well