Windows 10: Event Viewer

Is there any way to clear the items listed in 'administrative events' in event viewer? TIA, Richard

:)

 

Delete Event Log Files created in one month

Rishad,

I noticed that some type of XML coding might help to export.

I export the logs basically based on the setup of the events. For example, you have Event Viewer (Local) -> Windows Logs -> Security. And I export them to )say the month of April):

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\Comma Separated Value - CSV\04.csv

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\Event Viewer\No Display Information\04.evtx

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\Event Viewer\Display Information for English\04..evtx

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\Event Viewer Current View - XML\04.xml

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\TXT\04.txt

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\XML\No Display Information\04.xml

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\XML\Display Information for English\04.xml

What is getting a bit more difficult is creating the Event Viewer (Local) -> Applications and Services Logs -> Dell (OK a bit easy), but then you have Event Viewer (Local) -> Applications and Services Logs -> Microsoft -> Windows -> AAD. Which goes to:

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\Comma Separated Files - CSV\01.csv

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\Event Files\No Display Information\01.evtx

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\Event Files\Display Information for English\01.evtx

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\TXT\01.txt

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\XML\No Display Information\01.xml

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\XML\Display Information for English\01.xml

So maybe if an XML export can some export / create the proper documents, that would be great!

Thank you!

 

Windows Store

Hi,

We can look into the Even viewer logs to diagnose the issue. Event Viewer is a tool that shows detailed information about significant events on your computer. Event Viewer can be helpful when troubleshooting problems in Windows. To open Event Viewer type
Event Viewer in the search box and click View event logs.

 

You can execute attached batch script to delete all event logs. Make sure to execute the batch script as a administrator.

 

Hi,

Double click any event in the admin log and choose "delete". That will clear it.

Cheers, *Wink

 

Thanks for the reply FreeBooter. If I run the batch script, will it remove all the events? My main concern is in administrative events. I had a corrupt file that was issuing critical events every 10 seconds or so. It accumulated thousands of events. Once I fixed the file, the critical events stopped.
PS fdegrove: when I double click on a particular event, it just opens a details box pertaining to the event. Even so, it would take me forever to do them one at a time. But thanks anyway for your response.

 

Yes batch script will delete all event logs even administrative event logs are deleted.

 

Hi,
@RichardC :

Selecting one event and double clicking it will allow you to delete not just that one but actually clear the admin log in a single go.

Cheers, *Wink

 

When I double click on an event, I don't have the option to delete. Only Copy and Close.

 

"Administrative Events" is a predefined filter showing events from a number of logs; you can only clear those by clearing the associated individual event logs, which you may not want to do. I would recommend to leave well enough alone, unless you want to clear all the associated logs. You can also backup the logs and save them to event files before deleting them.

 

If you are planning an in place upgrade repair to move from 1703 to 1709 that will also clean the events.

 

Hi,
@Clint: I made a mistake, it's "Event Viewer Local" that you can clear that way, not the "Administrative Events" log. Sorry about that.

Cheers, *Wink

 

Thank you everyone. zbook, I'm already running v1709. I did run a drive cleaner and it did wipe out some of the unwanted items in administrative events. The others I can live with. Thank you everyone, Richard