You can clear events in an event log by using Event Viewer or by using the wevtutil command on a command line.
|To clear an event log by using Event Viewer|
Start Event Viewer.
In the console tree, navigate to the event log you want to clear.
On the Action menu, click Clear Log.
You can either clear the event log or save a copy of the event log and then clear it.
- To clear the event log without saving:
- To clear the event log after saving:
Click Save and Clear, type a name for the saved file in
File name on the Save As dialog box and click
- To clear the event log without saving: Click Clear.
|To clear an event log by using a command line|
To open a command prompt, click Start, type cmd in the Start Search box, and then press Enter.
Type the following command:
wevtutil cl <LogName> [/bu: <backup_file_name>]
To learn more about the clear log option of the wevtutil command-line tool, type the following command at a command prompt:
wevtutil cl -?
- You must have Clear permission on the log to
perform this operation. By default, Administrators have permission
to clear event logs. To set the Clear permission on a log for other
groups, type the following command at a command prompt:
wevtutil sl <LogName> /ca:<SecurityDescriptor>
To construct an SDDL string, note that there are three distinct rights that pertain to event logs: Read, Write, and Clear. These rights correspond to the following bits in the access rights field of the ACE string:
- 1= Read
- 2 = Write
- 4 = Clear
wevtutil gl <LogName>
wevtutil sl Application /ca:O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)(A;;0x4;;;BO)
- 1= Read