How to use the wevtutil command to manage event logs in Windows
Jul 30, 2025 am 05:03 AMThe wevtutil command is used to manage Windows event logs via command line. 2. To list all logs, use wevtutil el; to get details about a specific log like System, use wevtutil gl System. 3. Query events with wevtutil qe, such as wevtutil qe System /count:10 /f:text for the last 10 events in text format, and export logs using wevtutil epl System C:\temp\SystemLog.evtx. 4. Clear a log with wevtutil cl Application, but first back it up using wevtutil epl Application C:\backup\Application_Backup.evtx to preserve data. 5. For remote management, use /r:RemotePC with credentials via /u and /p, ensuring WinRM or RPC is enabled and firewall rules allow access. 6. Always run as Administrator for log modifications, use /f:renderedxml for readable XML output, filter output with findstr, and open exported .evtx files in Event Viewer for analysis, making wevtutil a powerful tool for automation, auditing, and troubleshooting of Windows event logs.
The wevtutil
command in Windows is a powerful command-line tool for managing event logs—useful for system administrators, IT pros, or anyone troubleshooting system or application events. It lets you query, export, clear, backup, and configure event logs without needing the Event Viewer GUI. Here's how to use it effectively.

1. Understanding wevtutil Basics
wevtutil
stands for Windows Event Log Utilities. It works with both built-in logs (like Application
, System
, Security
) and custom logs. You can run it from Command Prompt or PowerShell with appropriate permissions (some operations require Administrator rights).
General syntax:

wevtutil [action] [logname|query] [options]
Common actions include:
el
– Enumerate logsgl
– Get log informationqe
– Query eventsepl
– Export logcl
– Clear logal
– Archive log
2. List and Inspect Event Logs
To see all available logs on the system:

wevtutil el
This outputs a list like:
Application System Security Setup Windows PowerShell
To get detailed info about a specific log (e.g., System):
wevtutil gl System
This shows:
- Log size
- Maximum size
- Retention settings
- Enabled status
- Path to log file
Useful for checking if a log is full or if retention is configured properly.
3. Query and Export Event Logs
To retrieve events from a log, use qe
. For example, get the last 10 events from the System log:
wevtutil qe System /count:10 /f:text
Common formatting options:
/f:text
– Human-readable text/f:xml
– Raw XML (useful for scripting)/f:renderedxml
– Includes rendered message text in XML
To export the entire System log to an .evtx
file:
wevtutil epl System C:\temp\SystemLog.evtx
?? Make sure the target directory (e.g.,
C:\temp
) exists.
You can also filter events using XPath queries. For example, get Error-level events from System:
wevtutil qe System /q:"*[System/Level=2]" /f:text > C:\temp\Errors.txt
- Level 1 = Critical
- Level 2 = Error
- Level 3 = Warning
- Level 4 = Information
4. Clear or Backup Logs
To clear a log (e.g., Application log):
wevtutil cl Application
?? This permanently deletes all events in the log. Use with caution.
To archive and save a log before clearing:
wevtutil epl Application C:\backup\Application_Backup.evtx wevtutil cl Application
This is useful for compliance or debugging.
5. Advanced: Managing Remote Logs
You can use wevtutil
on remote machines if you have admin rights and WinRM or RPC enabled.
To query logs on a remote computer:
wevtutil el /r:RemotePC /u:Domain\Admin /p:Password
Or query events remotely:
wevtutil qe System /r:RemotePC /u:Admin /p:Pass123 /f:text
Note: Remote access may be blocked by firewall or group policy. Use
/r
with proper credentials.
6. Common Tips and Gotchas
- Always run Command Prompt as Administrator when modifying logs (especially Security log).
- Use
/f:renderedxml
if you need message text in exported XML—regular/f:xml
may only include event IDs. - Combine with
findstr
to filter text output:wevtutil qe System /f:text | findstr "error"
- Exported
.evtx
files can be opened in Event Viewer by dragging them into the console.
Basically, wevtutil
gives you scriptable, precise control over Windows event logs—whether you're auditing, troubleshooting, or automating log maintenance. It’s not flashy, but once you know a few key commands, it’s faster and more flexible than clicking through the GUI.
The above is the detailed content of How to use the wevtutil command to manage event logs in Windows. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

To run programs as administrator, you can use Windows' own functions: 1. Right-click the menu to select "Run as administrator", which is suitable for temporary privilege hike scenarios; 2. Create a shortcut and check "Run as administrator" to achieve automatic privilege hike start; 3. Use the task scheduler to configure automated tasks, suitable for running programs that require permissions on a scheduled or background basis, pay attention to setting details such as path changes and permission checks.

The problem of slow booting can be solved by the following methods: 1. Check and disable unnecessary booting programs; 2. Turn off the quick boot function; 3. Update the driver and check disk health; 4. Adjust the number of processor cores (only for advanced users). For Windows 11 systems, first, the default self-start software such as QQ and WeChat are disabled through the task manager to improve the startup speed; if you use dual systems or old hardware, you can enter the power option to turn off the quick boot function; second, use the device manager to update the driver and run the chkdsk command to fix disk errors, and it is recommended to replace the mechanical hard disk with SSD; for multi-core CPU users, the kernel parameters can be adjusted through bcdedit and msconfig to optimize the startup efficiency. Most cases can be corrected by basic investigation

RelatedWhat Clock Speed Means and Why It’s Not the Only Factor in Choosing a CPUTick, tock, is that a clock?PostsFor years, people have tried to get better performance from CPUs (and other PC parts) by overclocking them—running the clock speed higher

If you're having trouble reading your desktop icons' text or simply want to personalize your desktop look, you may be looking for a way to change the font color on desktop icons in Windows 11. Unfortunately, Windows 11 doesn't offer an easy built-in

Uninstalling the problematic Windows update can solve the system instability problem. The specific steps are as follows: 1. Find the list of recently installed updates through "Settings" > "Update and Security" > "Windows Update" > "View Update History" and confirm the problem update; 2. Open the control panel, go to "Programs" > "Uninstall Programs" > "View Installed Updates", select the target update and uninstall, and restart it after the operation; 3. If you cannot enter the system, you can boot with the Windows installation USB drive, enter the "Command Prompt" to execute the wusa/uninstall/kb:XXXXXXX command to uninstall the update. Note that cumulative updates may affect multiple patches, and it is recommended to backup in advance

If you need to obtain the Windows 11 product key, the answer depends on how you get the system. 1. If the system is pre-installed (OEM authorization), the key is usually embedded in the firmware and cannot be directly accessed and will be automatically activated during reinstallation; 2. You can use BelarcAdvisor, ProduKey and other tools to extract the key from the system, but you must ensure that the source is trustworthy; 3. If purchased or activated through a Microsoft account, you can log in to account.microsoft.com to view the associated key and digital license; it is necessary to note that the retail key can be transferred, while the OEM key is usually bound to the original hardware.

Fixed Windows 11 Google Chrome not opening Google Chrome is the most popular browser right now, but even it sometimes requires help to open on Windows. Then follow the on-screen instructions to complete the process. After completing the above steps, launch Google Chrome again to see if it works properly now. 5. Delete Chrome User Profile If you are still having problems, it may be time to delete Chrome User Profile. This will delete all your personal information, so be sure to back up all relevant data. Typically, you delete the Chrome user profile through the browser itself. But given that you can't open it, here's another way: Turn on Windo

When Windows cannot detect a second monitor, first check whether the physical connection is normal, including power supply, cable plug-in and interface compatibility, and try to replace the cable or adapter; secondly, update or reinstall the graphics card driver through the Device Manager, and roll back the driver version if necessary; then manually click "Detection" in the display settings to identify the monitor to confirm whether it is correctly identified by the system; finally check whether the monitor input source is switched to the corresponding interface, and confirm whether the graphics card output port connected to the cable is correct. Following the above steps to check in turn, most dual-screen recognition problems can usually be solved.
