Windows 10: Clear All Event Logs in Event Viewer in Windows

It may have even been here somewhere I started on this thread back in the Windows 7 Forums I think .
Most seem to be the same commands and most do clean them all but I would love to have a copy of the contents before it is gone forever if possible. *Smile

 

Hello questorfla, *Smile

You can select a "Windows Log" in the left pane, then select "Save all events as" in the right pane to save them.

 

You are always right on the money !
I cannot believe i read every post looking for that option to be added to all those that dumped them all.
On systems that have been in use by others that I have to reload from scratch for a new employee, i want to save everything from the previous users history that I can but would rather the next user started out with zero entries.
Helps me know later if it is the machine or "human" when the errors show up *Smile

 

You're most welcome. *Smile

 

Hi Brink
may i know where does w10 store all the event logs ?
is there a folder?
i found this fix SharePoint Administration: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed
maybe could be usefull for someone
thanks

 

Hello drugo,

The event logs are stored in the folder below. *Smile

%SystemRoot%\System32\Winevt\Logs

 

Hi Brink
thanks a lot

is there an utility to open these logs taken for example from an image?
i mean i would like to mount an image made some days ago , save this folder from the image to H:\event
is there a program that can open them ?
my event viewer can't do it , there is no any load features
just to track when the error did appear

thanks again Brink , always the number 1°


ps i tried to post a link , but i guess it's against the rules ,isn't it?

 

Sure you, could mount the image file, then be able to access and open them as usual.

 

Hi
but if i open myeventview it points to the%SystemRoot%\System32\Winevt\Logs , and not to my image
need a program to open them

 

@drugo I think he means on the mounted image,
find C:\WINDOWS\System32\Winevt\Logs,
then you just double click the the log you want to view and Event Viewer should open up so you can read it.

When you mount it, make sure you give access to restricted folders, and make it writable(the writable only happens in memory and doesn't make any permanent changes).
***Note: Some logs are just plain empty.***

Here is a quick screen capture I just made to show you. It's not meant to be a video tutorial, but should give you an idea of how to do it, I hope it get's you further*Smile

***I just fixed the video a bit, and added a small explanation of what to do.***

[youtube]dIH0q-Z_-1Q[/youtube]

 

Hi Cliff
Amazing!!!!!
thanks a lot!
can i download the youtube video ?

 

You're welcome drugo!
I'm glad it helped.
You should be able to. I'm new at posting on YouTube, so if you can't, let me know what I need to set, so it can be.

 

@Brink,
Hey Shawn, I've been messing around now with the mounted Macrium image option for a bit.
Even though it say "Make writable Note: Changes are temporary and will be discarded", I have found out, you can copy from the mounted image, and paste into the "host".

This might come in useful to repair something, or get an installer(like maybe a driver or 3rd party program, you need to repair or reinstall without have to reimage and loose current updates and changes. I have successfully copy & pasted .dlls and other system files.

It might be worth a tutorial, for non invasive repairs. Or, would this be more of something, for the video geeks?

 

@Cliff S, @Brink - Just an add-on... Same procedure can be used on a Restore Point. A small utility System Restore Explorer | Nics Blog can be used to mount a Restore Point. Copy/paste to host any file in the restore point, user data, system data, etc. Delete the Restore Point if desired. Just thought I'd pass it on. TC

 

FWIW CCleaner will clear the Event Viewer Logs - just check the box under Windows>Advanced>Windows Events Logs. run CCleaner and it's that simple. Much faster than most ,bat files I've tried. Just a suggestion.