Deleting Events in Your Event Logs

Written by Barry Dysert (last updated March 23, 2020)

1

Event logs do take up some space on your hard drive, but they don't grow forever. By default, every event log has a retention policy that indicates old events are to be overwritten by new events whenever the event log gets full. For various reasons, though, you may want to delete events from your event logs. Unfortunately, you cannot delete specific events. You can, however, clear the entire log.

If you want to totally clear a log so that it's empty, start the Event Viewer by using the search capabilities of Windows to look for "Event Viewer" (without the quote marks). Once the program is started, use the left pane to navigate to the log you want to clear. Right-click on the log and select Properties. Windows displays the Log Properties dialog box. (See Figure 1.)

Figure 1. Viewing an event log's properties.

By clicking the Clear Log button in the lower-right corner, you can totally clear that event log.

Even though you can't delete specific events from a log, it may be useful to create a custom view so that you're only looking at the events of interest instead of everything. To create a custom view, click the log for which you want to create the view, then on the right pane, click the "Create Custom View" link. Unless/until Microsoft gives us the ability to delete specific events, views are probably as close as we're going to get.

 This tip (11722) applies to Windows 7, 8, and 10.

Author Bio

Barry Dysert

Barry has been a computer professional for over 35 years, working in different positions such as technical team leader, project manager, and software developer. He is currently a software engineer with an emphasis on developing custom applications under Microsoft Windows. When not working with Windows or writing Tips, Barry is an amateur writer. His first non-fiction book is titled "A Chronological Commentary of Revelation." ...

MORE FROM BARRY

Saving a Windows Search

Windows has a built-in search utility that allows you to search for strings inside of files. You can even save your ...

Discover More

Removing Locations from the Search Index

You can fine-tune Indexed Searches by removing locations from the search index. This tip tells you how.

Discover More

PowerShell Input and Output

When dealing with a scripting language like PowerShell, one of the first things you need to learn is how to get data into ...

Discover More
More WindowsTips

What is the Purpose of the Security Event Log?

The Security event log captures success and failure audit events when auditing is turned on. This tip explains a bit more ...

Discover More

What is the Purpose of the Application Event Log?

The Application event log holds messages generated by applications and services. This tip explains more about it.

Discover More

What is the Purpose of the System Event Log?

The System event log holds messages generated by device drivers. This tip explains more about it.

Discover More
Comments

If you would like to add an image to your comment (not an avatar, but an image to help in making the point of your comment), include the characters [{fig}] (all 7 characters, in the sequence shown) in your comment text. You’ll be prompted to upload your image when you submit the comment. Maximum image size is 6Mpixels. Images larger than 600px wide or 1000px tall will be reduced. Up to three images may be included in a comment. All images are subject to review. Commenting privileges may be curtailed if inappropriate images are posted.

What is one less than 7?

2021-05-24 10:30:58

Paulette Walls

Good morning. Someone deleted my event log after I reported that two individuals was listed as having Direct Access to my one drive without my knowledge. The same day I reported this information, the names listed were removed. IT claims the names were never listed there and they have no event log that showed this transaction ever happened. I had a supervisor and co-worker look at my computer to prove that I wasn’t lying about the incident before even reporting it. What command prompt on deleted logs would I look for to prove what I’m saying is true? Is there anything else I can do to prove what I’m saying is true computer wise?


Newest Tips