How to use the wevtutil command to manage event logs in Windows

The wevtutil command is used to manage Windows event logs via command line. 2. To list all logs, use wevtutil el; to get details about a specific log like System, use wevtutil gl System. 3. Query events with wevtutil qe, such as wevtutil qe System /count:10 /f:text for the last 10 events in text format, and export logs using wevtutil epl System C:\temp\SystemLog.evtx. 4. Clear a log with wevtutil cl Application, but first back it up using wevtutil epl Application C:\backup\Application_Backup.evtx to preserve data. 5. For remote management, use /r:RemotePC with credentials via /u and /p, ensuring WinRM or RPC is enabled and firewall rules allow access. 6. Always run as Administrator for log modifications, use /f:renderedxml for readable XML output, filter output with findstr, and open exported .evtx files in Event Viewer for analysis, making wevtutil a powerful tool for automation, auditing, and troubleshooting of Windows event logs.

The wevtutil command in Windows is a powerful command-line tool for managing event logs—useful for system administrators, IT pros, or anyone troubleshooting system or application events. It lets you query, export, clear, backup, and configure event logs without needing the Event Viewer GUI. Here's how to use it effectively.

1. Understanding wevtutil Basics

wevtutil stands for Windows Event Log Utilities. It works with both built-in logs (like Application, System, Security) and custom logs. You can run it from Command Prompt or PowerShell with appropriate permissions (some operations require Administrator rights).

General syntax:

wevtutil [action] [logname|query] [options]

Common actions include:

• el – Enumerate logs
• gl – Get log information
• qe – Query events
• epl – Export log
• cl – Clear log
• al – Archive log

2. List and Inspect Event Logs

To see all available logs on the system:

wevtutil el

This outputs a list like:

Application
System
Security
Setup
Windows PowerShell

To get detailed info about a specific log (e.g., System):

wevtutil gl System

This shows:

• Log size
• Maximum size
• Retention settings
• Enabled status
• Path to log file

Useful for checking if a log is full or if retention is configured properly.

3. Query and Export Event Logs

To retrieve events from a log, use qe. For example, get the last 10 events from the System log:

wevtutil qe System /count:10 /f:text

Common formatting options:

• /f:text – Human-readable text
• /f:xml – Raw XML (useful for scripting)
• /f:renderedxml – Includes rendered message text in XML

To export the entire System log to an .evtx file:

wevtutil epl System C:\temp\SystemLog.evtx

⚠️ Make sure the target directory (e.g., C:\temp) exists.

You can also filter events using XPath queries. For example, get Error-level events from System:

wevtutil qe System /q:"*[System/Level=2]" /f:text > C:\temp\Errors.txt

• Level 1 = Critical
• Level 2 = Error
• Level 3 = Warning
• Level 4 = Information

4. Clear or Backup Logs

To clear a log (e.g., Application log):

wevtutil cl Application

⚠️ This permanently deletes all events in the log. Use with caution.

To archive and save a log before clearing:

wevtutil epl Application C:\backup\Application_Backup.evtx
wevtutil cl Application

This is useful for compliance or debugging.

5. Advanced: Managing Remote Logs

You can use wevtutil on remote machines if you have admin rights and WinRM or RPC enabled.

To query logs on a remote computer:

wevtutil el /r:RemotePC /u:Domain\Admin /p:Password

Or query events remotely:

wevtutil qe System /r:RemotePC /u:Admin /p:Pass123 /f:text

Note: Remote access may be blocked by firewall or group policy. Use /r with proper credentials.

6. Common Tips and Gotchas

• Always run Command Prompt as Administrator when modifying logs (especially Security log).
• Use /f:renderedxml if you need message text in exported XML—regular /f:xml may only include event IDs.
• Combine with findstr to filter text output:

  wevtutil qe System /f:text | findstr "error"

• Exported .evtx files can be opened in Event Viewer by dragging them into the console.

---

Basically, wevtutil gives you scriptable, precise control over Windows event logs—whether you're auditing, troubleshooting, or automating log maintenance. It’s not flashy, but once you know a few key commands, it’s faster and more flexible than clicking through the GUI.

The above is the detailed content of How to use the wevtutil command to manage event logs in Windows. For more information, please follow other related articles on the PHP Chinese website!