Event logs do take up some space on your hard drive, but they don't grow forever. By default, every event log has a retention policy that indicates old events are to be overwritten by new events whenever the event log gets full. For various reasons, though, you may want to delete events from your event logs. Unfortunately, you cannot delete specific events. You can, however, clear the entire log.
If you want to totally clear a log so that it's empty, start the Event Viewer by using the search capabilities of Windows to look for "Event Viewer" (without the quote marks). Once the program is started, use the left pane to navigate to the log you want to clear. Right-click on the log and select Properties. Windows displays the Log Properties dialog box. (See Figure 1.)
Figure 1. Viewing an event log's properties.
By clicking the Clear Log button in the lower-right corner, you can totally clear that event log.
Even though you can't delete specific events from a log, it may be useful to create a custom view so that you're only looking at the events of interest instead of everything. To create a custom view, click the log for which you want to create the view, then on the right pane, click the "Create Custom View" link. Unless/until Microsoft gives us the ability to delete specific events, views are probably as close as we're going to get.
This tip (11722) applies to Windows 7, 8, and 10.
The Security event log captures success and failure audit events when auditing is turned on. This tip explains a bit more ...
Discover MoreFiltering a log in the Event Viewer allows you quick access to those events you're interested in watching over time. This ...
Discover MoreEvent logs are used to store information about what goes on, behind the scenes, on your system. Whether you want to ...
Discover More2021-05-24 10:30:58
Paulette Walls
Good morning. Someone deleted my event log after I reported that two individuals was listed as having Direct Access to my one drive without my knowledge. The same day I reported this information, the names listed were removed. IT claims the names were never listed there and they have no event log that showed this transaction ever happened. I had a supervisor and co-worker look at my computer to prove that I wasn’t lying about the incident before even reporting it. What command prompt on deleted logs would I look for to prove what I’m saying is true? Is there anything else I can do to prove what I’m saying is true computer wise?
Copyright © 2025 Sharon Parq Associates, Inc.
Comments