Windows 10: Cannot Event Log files - Cannot set properties using wevtutil

After I upgraded Windows 7 Pro to Windows 10 Pro 1903, I cannot read the event log file using event viewer.


We get an error message 1338 security descriptor invalid.


Looking into the issue, discovered the event log files do not have any channel access (security descriptor info) entries. When I run wevtutil gl logname, channel access is empty. I assume that is the problem?

When I try to set the SD using wevtutil sl logname /channelaccess:SD the command completes successfully, but when I look at the channel access value after the command completes using wevtutil gl logname, the channel access is empty.

In addition, using wevtutil sl no values can be changed, command completes successfully but the values don't appear to be updated

Anyone know how to resolve this issue?

:)

 

Saves log files ?

You can either read the files in Windows or my preferred method is.....

Download CCcleaner from here...........

CCleaner Professional | Try the world’s most trusted PC cleaner, free!

You can then run cleaner, you will see the log files listed, then if you right click you can save as a text file and then have a read. You may also get an "error reporting" log listed seperatly.

 

Clearing Administrative Events Log in Windows10

How To Clear Administrative Events Log

The Administrative Events log (listed under Custom Views) in the Event Viewer is a Filter that contains all of the event from the System, Security and Application event logs.

You can either clear these individual logs, or use the instructions below to clear all the event logs.

To Clear All Event Logs in Event Viewer in Windows

cmd shell solution:

PowerShell solution:

Source How to Clear All Event Logs in Event Viewer in Windows

To Clear Individual Event Viewer Logs in Event Viewer

Source How to Clear All Event Logs in Event Viewer in Windows

 

huge event log ,how can i fix it?


Try this:

1. Go to Search, type powershell, right click on PowerShell and choose Run as administrator
2. Enter the following line into PowerShell and press Enter:
   • wevtutil el | Foreach-Object {wevtutil cl “$_”}
   • This did not remove all but some. *Cool