Event logs do take up some space on your hard drive, but they don't grow forever. By default, every event log has a retention policy that indicates old events are to be overwritten by new events whenever the event log gets full. For various reasons, though, you may want to delete events from your event logs. Unfortunately, you cannot delete specific events. You can, however, clear the entire log.
If you want to totally clear a log so that it's empty, start the Event Viewer by using the search capabilities of Windows to look for "Event Viewer" (without the quote marks). Once the program is started, use the left pane to navigate to the log you want to clear. Right-click on the log and select Properties. Windows displays the Log Properties dialog box. (See Figure 1.)
Figure 1. Viewing an event log's properties.
By clicking the Clear Log button in the lower-right corner, you can totally clear that event log.
Even though you can't delete specific events from a log, it may be useful to create a custom view so that you're only looking at the events of interest instead of everything. To create a custom view, click the log for which you want to create the view, then on the right pane, click the "Create Custom View" link. Unless/until Microsoft gives us the ability to delete specific events, views are probably as close as we're going to get.
This tip (11722) applies to Windows 7, 8, and 10.
The Forwarded Events event log collects events that have been forwarded from other computers. In this way you can login ...
Discover MoreManaging a computer system can often involve a good deal of detective work. This tip looks at how you can use your ...
Discover MoreThe Application event log holds messages generated by applications and services. This tip explains more about it.
Discover More2021-05-24 10:30:58
Paulette Walls
Good morning. Someone deleted my event log after I reported that two individuals was listed as having Direct Access to my one drive without my knowledge. The same day I reported this information, the names listed were removed. IT claims the names were never listed there and they have no event log that showed this transaction ever happened. I had a supervisor and co-worker look at my computer to prove that I wasn’t lying about the incident before even reporting it. What command prompt on deleted logs would I look for to prove what I’m saying is true? Is there anything else I can do to prove what I’m saying is true computer wise?
Copyright © 2024 Sharon Parq Associates, Inc.
Comments