Under Windows 7 you open the Event Viewer to browse several categories. You can also clear a single category by clicking Clear Log... on the right pane.
Assuming I want to clear ALL categories, am I supposed to click and clear them one by one?
There are dozens of them. Is there a faster way? Maybe with PowerShell?
Open cmd prompt or create batch script and "run as admin":
for /f %x in ('wevtutil el') do wevtutil cl "%x"
Powershell code for clearing all event logs:
wevtutil el | Foreach-Object {Write-Host "Clearing $_"; wevtutil cl "$_"}
or pick and choose in a script:
wevtutil.exe cl Analytic
wevtutil.exe cl Application
wevtutil.exe cl DirectShowFilterGraph
wevtutil.exe cl DirectShowPluginControl
wevtutil.exe cl EndpointMapper
wevtutil.exe cl ForwardedEvents
wevtutil.exe cl HardwareEvents
wevtutil.exe cl Internet Explorer
wevtutil.exe cl Key Management Service
wevtutil.exe cl MF_MediaFoundationDeviceProxy
wevtutil.exe cl "Media Center"
wevtutil.exe cl MediaFoundationDeviceProxy
wevtutil.exe cl MediaFoundationPerformance
wevtutil.exe cl MediaFoundationPipeline
wevtutil.exe cl MediaFoundationPlatform
wevtutil.exe cl Microsoft-IE/Diagnostic
wevtutil.exe cl Microsoft-IEFRAME/Diagnostic
wevtutil.exe cl Microsoft-PerfTrack-IEFRAME/Diagnostic
wevtutil.exe cl Microsoft-PerfTrack-MSHTML/Diagnostic
etc...
You can get a complete list of all event category names by typing the following in a cmd prompt or powershell:
wevtutil el
More information can be found at MS TechNet. Examples:
Export events from System log to C:\backup\system0506.evtx:
wevtutil epl System C:\backup\system0506.evtx
Clear all of the events from the Application log after saving them to C:\admin\backups\a10306.evtx:
wevtutil cl Application /bu:C:\admin\backups\a10306.evtx
There's no way via the GUI to clear all logs at once. At least not that I've ever found. :)
Here's a batch file that uses WEVTUTIL.exe to list the logs into a text file, and then use that text file to delete each of the logs.
WEVTUTIL EL > .\LOGLIST.TXT
for /f %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"
del .\LOGLIST.TXT
timeout 30
If you feel unsafe having this all in one batch file, then you can save this to two separate files and then run one after the other:
(The "Nuke" batch will just error out if it doesn't find a "loglist.txt" in its current directory.)
@ECHO OFF
REM Source: https://superuser.com/a/655185/389368
WEvtUtil.exe enum-logs > .\LOGLIST.TXT
@ECHO OFF
REM Source: https://superuser.com/a/655185/389368
for /f %%a in ( .\LOGLIST.TXT ) do WEvtUtil.exe clear-log "%%a"
del .\LOGLIST.TXT
timeout 30
As Logman pointed out in his answer, this can be further shortened down (and eliminate the need for the intermediate text file) by using something like (%'s double for batch file):
for /f %%a in ('WEVTUTIL EL') do WEVTUTIL CL "%%a"
timeout 30
Whichever way you choose, ensure you "Run As Administrator".
Easiest solution I've found. Been using it since Vista. :)
wevtutil is quite slow, specially when you clear all logs (including empty ones)
fastest solution I came up with:
ForEach ( $l in ( Get-WinEvent * ).LogName | sort | get-unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog("$l")}
Resul: "Cleared 16 events in 4 logs: 0.3684785 seconds"
Each part:
only gets logs containing events (there will be duplicate LogNames)
ForEach ( $l in ( Get-WinEvent * ).LogName | sort | get-unique )
clear each one
System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog( "$l" )
Full function:
function Clear-EventLogs
{
Begin
{
$t1 = ( Measure-Command -Expression{ $active = ( Get-WinEvent ).LogName } ).TotalSeconds
$totalEvents = $active.Count
$active = $active | Sort | Get-Unique
$totalLogs = $active.Count
}
Process
{
$t2 = ( Measure-Command -Expression{
ForEach ( $l in $active )
{
[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog( "$l" )
# ForEach-Object { Wevtutil.exe cl "$l" }
}
} ).TotalSeconds
}
End { $t3 = $t1 + $t2; Write-Output "Cleared $totalEvents events in $totalLogs logs: $t3 seconds" }
}
If you see "Get-WinEvent : The data is invalid", you've hit the undocumented hard-limit of 256 logs. It may be necessary to filter the logs first. The following will select only the logs that have events (credit to http://www.powershellish.com/blog/2015/01/19/get-winevent-max-logs/ for the diagnosis ):
$logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName
ForEach ( $l in ( Get-WinEvent $logs ).LogName | sort | get-unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog("$l")}
It is important to use the delim option if you have spaces in the names:
WEVTUTIL EL > .\LOGLIST.TXT
for /f "delims=" %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"
You can also easily disable all event logging without stopping the event log service:
for /f "delims=" %%a in ('WEVTUTIL EL') do WEVTUTIL SL "%%a" /e:false
Of course this will only disable actually installed software events, if you install a new software, it will have the logging enabled by default. But good thing you can leave the Task Scheduler running, so just do it every month ;-)
BTW, this clears all the Log files, which can (depending on previous settings) free up quite some space
WEVTUTIL EL > .\LOGLIST.TXT
for /f "delims=" %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"
del .\LOGLIST.TXT
timeout 10
I've used .bat files to make it a little bit easier to clear log files. Just picked the simple script here http://winaero.com/blog/how-to-clear-the-windows-event-log-from-the-command-line/
Copied from that link.
@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo Event Logs have been cleared!
goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
echo You must run this script as an Administrator!
echo.
:theEnd
Open Notepad and copy-paste the that text into it.
Save it as a batch file and give it any name you want for example: ClEvtLog.bat or ClEvtLog.cmd.
Run it with admin rights.
