Windows 10: What is WevtUtil and how do you use it?

​

WevtUtil.exe is a command-line utility in the Windows operating system, used primarily to register your Provider on the computer. The tool is placed in %windir%\System32 folder. This command is limited to members of the Administrators group and must be run with elevated privileges. In this post, we discuss how to use this inbuilt tool in […]

This article What is WevtUtil and how do you use it? first appeared on TheWindowsClub.com.

read more...

 

wevtutil

I am trying to export the following events with specific event id i am able to get all the events for particular NetworkProfile but unable to get the results only with event id. I am using the following command.

wevtutil epl Microsoft-Windows-NetworkProfile/Operational filename.evtx "/q:*[EventId=10000]"

 

wevtutil

This question is beyond the scope of this consumer-oriented forum. You might get an answer in the TechNet or MSDN forums (see, e.g.,

https://social.technet.microsoft.com/Forums/en-US/home?forum=whatforum&filter=alllanguages).

I think that the syntax of your query is incorrect, but I can't help you any further than that.

See
http://blog.commandlinekungfu.com/2009/10/episode-66-log-jam.html, which includes this quote:

"The wevtutil query syntax is impossibly complex, and something I frankly loath." I completely agree. Everything about this command is sideways, even the default format isn't readable. I highly suggest using PowerShell since anything
but the most basic query gets ugly. However, this command gives us a lot of control over the event log besides querying such as enumerating logs, getting or setting log configuration, getting log status, exporting, archiving, and clearing logs.

Also see
https://www.petri.com/command-line-event-log

 

huge event log ,how can i fix it?

Try this:

1. Go to Search, type powershell, right click on PowerShell and choose Run as administrator
2. Enter the following line into PowerShell and press Enter:
   • wevtutil el | Foreach-Object {wevtutil cl “$_”}
   • This did not remove all but some. *Cool