How to Clear Event Viewer Logs in Windows 11 & 10 (and Read What Matters)

To clear a log in Event Viewer, press Windows + R, type eventvwr.msc, open Windows Logs, right-click Application, System or another log, and choose Clear Log, then Save and Clear to keep a copy or Clear to empty it. To clear every log at once, open Terminal as administrator and run wevtutil el | ForEach-Object { wevtutil cl "$_" }. Here is what most guides do not tell you: clearing Event Viewer fixes nothing and does not speed Windows up. The red errors you see are mostly normal background noise, logs have a size limit and recycle themselves, and clearing a log leaves its own record (event 104, or 1102 for the Security log). Clear logs to start a clean diagnosis, not to make the errors "go away".

Ethan's father opened Event Viewer for the first time after a friend mentioned it, and was alarmed: hundreds of red errors and yellow warnings, some from years ago. He cleared every log, felt better, and the next morning there were dozens of new ones. He called Jake, worried the PC was failing. Jake explained that a healthy Windows PC logs errors constantly, most of them harmless, and that the useful skill is not clearing logs but reading the few that matter. They saved the logs, cleared them, reproduced the actual problem, a printer that disconnected every afternoon, and found the one event that explained it in two minutes. That is the right way to use clearing: as a clean slate for a specific investigation. This page covers how, and how to read what comes next.

Clearing logs needs an administrator account. It removes only the log entries, never your files, apps or settings, and Windows starts recording again immediately.

Ways to clear Event Viewer logs

For a home PC, the first and last rows matter most: clear a single log when you are testing something specific, and otherwise let the overwrite setting manage logs for you.

wevtutil is built into every edition of Windows 11 and 10, including Home, so the command-line methods work everywhere without extra tools.

Open Event Viewer

• Press Windows + R, type eventvwr.msc, press Enter.
• Right-click Start (or press Windows + X) and choose Event Viewer.
• Press the Windows key and type Event Viewer.
• From Computer Management: compmgmt.msc > System Tools > Event Viewer.

The left pane lists Custom Views, Windows Logs (Application, Security, Setup, System, Forwarded Events) and Applications and Services Logs, which holds hundreds of detailed logs for individual Windows components. The middle pane shows events; the right pane has actions such as Filter, Find and Clear Log.

Event Viewer runs as an MMC console. Some actions, including clearing logs and viewing the Security log, need administrator rights; if a step on this page fails with access denied, close Event Viewer and open it again with right-click > Run as administrator.

Event levels: what the icons mean

Seeing many Errors and Warnings is normal. Critical events are rarer and deserve a look, especially Kernel-Power 41, which records unexpected restarts.

Filtering by level is the fastest way to cut the noise: choose only Critical and Error in Filter Current Log, and the list shrinks to the entries most likely to matter.

Clear a single log

1. Open Event Viewer and expand Windows Logs.
2. Right-click the log, such as Application or System, and choose Clear Log... (or select it and click Clear Log... in the Actions pane).
3. Choose Save and Clear to save a copy as an .evtx file first, or Clear to empty it without saving.

The log empties immediately and new events start appearing within seconds. Logs under Applications and Services Logs are cleared the same way: right-click the specific log, such as Microsoft > Windows > WindowsUpdateClient > Operational, and choose Clear Log.

If Clear Log is grayed out, you opened Event Viewer without administrator rights. Close it, right-click Event Viewer in Start, choose Run as administrator, and try again.

Clear all logs at once

Event Viewer has no "clear everything" button, but one command does it. Right-click Start and open Terminal (Admin). In PowerShell, run:

wevtutil el | ForEach-Object { wevtutil cl "$_" }

In Command Prompt, the equivalent is:

for /F "tokens=*" %1 in ('wevtutil el') do wevtutil cl "%1"

(In a .bat file, use %%1 instead of %1.) wevtutil el lists every log; wevtutil cl clears each one. A few logs may report "Access is denied" or "The process cannot access the file" because they are in use or protected; that is normal and harmless. Most logs, including the important Windows Logs, are cleared.

The command takes a few seconds to a minute, since Windows has several hundred logs. To clear only the main Windows Logs, use wevtutil cl Application, wevtutil cl System and wevtutil cl Setup one after another, which is quicker and leaves the detailed component logs intact for later troubleshooting. Leave the Security log out unless you have a specific reason to clear it.

Save logs before clearing

Logs are evidence. If you might need them later, for a repair shop, a support ticket or your own comparison, save them first:

• In Event Viewer: choose Save and Clear, or right-click a log and choose Save All Events As... to save without clearing. Choose .evtx to reopen later in Event Viewer, or .xml, .txt or .csv for other tools.
• By command: wevtutil epl System C:\Logs\System.evtx exports the System log; repeat for Application and others. Create the folder first.
• To reopen: in Event Viewer, Action > Open Saved Log..., and pick the .evtx file. It appears under Saved Logs without mixing with live logs.

Jake saved Ethan's father's logs before clearing them; it cost ten seconds and meant nothing was lost if an old event turned out to matter.

Name saved files with the date and log, such as 2026-10-02-System.evtx, so you can compare before and after a fix. Comparing the error lists of two saved logs is one of the clearest ways to confirm a fix actually worked.

Clear logs with PowerShell

In Windows PowerShell 5.1 (the version built into Windows), Clear-EventLog -LogName Application, System clears the classic logs, and Get-EventLog -List shows them with their sizes. These cmdlets are not available in PowerShell 7; there, use wevtutil as above, or Get-WinEvent -ListLog * to list logs and their record counts. To clear only logs that actually contain events, run:

Get-WinEvent -ListLog * -ErrorAction SilentlyContinue | Where-Object { $_.RecordCount -gt 0 } | ForEach-Object { wevtutil cl $_.LogName }

To see which logs are largest before clearing, run Get-WinEvent -ListLog * -ErrorAction SilentlyContinue | Sort-Object FileSize -Descending | Select-Object -First 10 LogName, RecordCount, FileSize. It shows where the space and noise actually are.

Set log size and stop logs filling up

Every log has a maximum size, after which Windows overwrites the oldest events. That is why logs never fill your drive and why clearing is rarely necessary. To adjust:

1. Right-click a log and choose Properties.
2. Set Maximum log size (KB). Defaults are about 20 MB for Application and System; larger sizes keep more history.
3. Choose Overwrite events as needed (oldest events first), the default and the right choice for home PCs.
4. Click OK.

The same dialog has a Clear Log button and shows the log's current size, file path and when it was created. The other options, Archive the log when full and Do not overwrite events, are for organizations with audit requirements; on a home PC, they can make logs grow or stop recording.

For troubleshooting a rare problem that happens once a week or so, raising the System and Application logs to 64 MB or more keeps enough history to catch it. The cost is a little disk space, which is usually well worth the extra days of evidence.

Red errors that are normal

A healthy Windows PC logs errors and warnings every day. Many come from services starting slightly out of order, drivers checking hardware that is not present, or apps reporting minor issues they recover from. Common examples that are usually harmless on their own:

• DistributedCOM 10016: permission messages from Windows components; extremely common and safe to ignore.
• Service Control Manager 7000 or 7009 for a service you do not use, such as a removed app's service.
• Kernel-Event Tracing warnings about session sizes.
• Time-Service warnings when the PC was offline and could not sync.
• Application errors for apps that crashed once and never again.

What matters is patterns: the same error at the same time as your problem, every time. That is why clearing logs before reproducing a problem is useful: whatever appears next is much more likely to be relevant.

If you are unsure whether an error matters, check whether it appears on other healthy PCs: searching the source and ID often shows thousands of people with the same harmless entry. Errors unique to your PC, at the times your problem happens, are the ones worth following.

Use a cleared log to diagnose a problem

1. Save and clear the System and Application logs.
2. Restart, then reproduce the problem: the crash, the disconnect, the freeze.
3. Note the exact time it happened.
4. Open Event Viewer, go to System and Application, and look at errors and warnings within a minute or two of that time.
5. Click an event and read the General tab; note the Source and Event ID.
6. Search the source and ID together, such as "Netwtw14 event 5002", for specific causes.

For Ethan's father's printer, the System log showed a USB power-management event at the exact minute it disconnected. Turning off USB selective suspend fixed it.

If the problem is intermittent, keep the cleared logs running for a day or two and note each time it happens; then compare those times with the events. A pattern across several occurrences is far more convincing than a single coincidence.

Reliability Monitor: a friendlier view

For a quicker overview, open Reliability Monitor: press Windows + R and type perfmon /rel. It turns the same logs into a daily timeline with a stability score, red crosses for crashes and failures, and blue icons for installs and updates. Click a day to see what happened, and View technical details for the underlying event. It is the easiest way to see when problems started and what changed just before. Clearing Event Viewer logs also removes the history Reliability Monitor draws on, another reason to clear sparingly.

The stability score is a rough guide rather than a precise grade; a single crash lowers it for days. Look at the red crosses and their dates rather than the number itself.

Run an action when an event happens

Event Viewer can trigger a task when a specific event appears. Right-click an event and choose Attach Task To This Event...; the wizard creates a Task Scheduler task that runs a program or script whenever that event occurs again. Uses include logging when a USB drive disconnects, restarting a service that crashes, or sending yourself a note when an unexpected shutdown happens. Keep these tasks simple and test them, since a task that fires on a frequent event can run very often.

To remove an attached task later, open Task Scheduler and look under Task Scheduler Library > Event Viewer Tasks, where these event-triggered tasks are stored, and delete it there.

Export events for support

When a support person asks for logs, send only what helps. Filter the log to the time of the problem, then right-click the filtered log and choose Save Filtered Log File As.... That saves just the matching events as an .evtx file, which is small and easy to email or upload. Check it does not include anything private, such as user names on a shared PC; the System and Application logs rarely do, the Security log often does.

Include the exact time of the problem and the time zone in your message; support staff can then jump straight to the right events instead of scrolling through hours of normal activity.

Filter instead of clearing

Often you do not need to clear anything; filtering hides the noise. Select a log, click Filter Current Log..., and choose a time range (Last hour, Last 24 hours), event levels (Critical, Error), sources or event IDs. The Custom Views > Administrative Events view shows errors and warnings from all logs in one list. Create your own custom view for problems you track, such as all Kernel-Power and WHEA events, so they are one click away.

Filters do not change the log; they only hide entries. Click Clear Filter in the Actions pane to see everything again. Filters you use often can be saved as a custom view with Save Filter to Custom View.

How to read an event

Click an event to see it below the list. The General tab shows the description in plain language, sometimes with a useful file or device name. Underneath are Log Name, Source (the component that wrote it), Event ID, Level, Logged (date and time), User and Computer. The Details tab shows the raw data, which sometimes includes codes not in the description, such as BugcheckCode for Kernel-Power 41. The Source and Event ID together are what you search for; descriptions alone are often too general to search usefully.

Many descriptions include a link called Event Log Online Help, which rarely leads anywhere useful today; searching the source and ID yourself is more productive.

Useful event IDs to know

Use the Event ID box in Filter Current Log to enter several IDs at once, separated by commas, such as 41,1001,6008, to see all crash-related entries together.

Find when your PC started and shut down

Filter the System log by event IDs 6005,6006,6008,1074 to see a history of starts, clean shutdowns, unexpected shutdowns and who or what started each restart. It answers questions like "did the PC restart overnight?" or "what restarted it at 3 a.m.?" in seconds; event 1074 usually names Windows Update, a program, or a user. Combined with the clear-and-reproduce method above, it pins down unexplained restarts quickly.

Windows 11 also logs Kernel-General 12 when the system starts and Kernel-General 13 when it shuts down, with precise times; add them to the filter for an even clearer picture of each session.

See failed sign-in attempts

The Security log records sign-ins: event 4624 for success and 4625 for failure, including the account name and the type of sign-in. Filter the Security log by 4625 to see whether someone has been trying your password. A few failures from your own typos are normal; dozens in a row, especially for accounts like Administrator or names you do not recognize, deserve attention, particularly on PCs with Remote Desktop open to the internet.

On Home editions, basic sign-in auditing is on by default. To see more detail, such as the source network address of failed remote sign-ins, open the event's Details tab. If you see attacks from the internet, close Remote Desktop to the outside or put it behind a VPN.

Find what was installed or removed, and when

Filter the Application log by source MsiInstaller and event IDs 11707,11724 to see programs installed and removed through Windows Installer, with dates. It is a handy way to see what arrived just before a problem started, such as a toolbar bundled with a free program, or which app another family member removed.

Programs installed with their own installers, rather than Windows Installer, may not appear here. For those, Settings > Apps > Installed apps sorted by install date gives the complementary view.

Store app installs and updates are logged separately, under Applications and Services Logs > Microsoft > Windows > AppXDeploymentServer > Operational, if you need the same history for Store apps.

Clearing the Security log

The Security log records sign-ins, permission changes and other audited events. Clearing it requires administrator rights and Windows records the clearing as event 1102 ("The audit log was cleared"), including which account did it. On a work PC, clearing the Security log can trigger security alerts and may break policy; do not do it. On a home PC there is little reason to clear it; it is not large and it can help investigate unexpected sign-ins.

If you are curious what the Security log contains, open it and filter by 4624 and 4625; the sign-in history is usually the most useful part for home users.

Warning: fake tech support and Event Viewer

Phone and pop-up scammers love Event Viewer. A caller claiming to be from Microsoft or your internet provider asks you to open Event Viewer, points at the hundreds of red errors, and says your PC is infected or failing, then asks for remote access or payment. Those errors are normal on every Windows PC. Microsoft does not call people about errors on their computer. If anyone shows you Event Viewer as proof of a problem and asks for money or remote access, hang up. If you already allowed access, disconnect from the internet, run a Microsoft Defender offline scan, change your important passwords from another device, and contact your bank if you paid.

Clearing leaves a trace

When the System log or another log is cleared, Windows writes event 104 in the System log ("The System log file was cleared"), and 1102 for Security. Clearing is therefore not a way to hide activity; it is visible to anyone who looks, and security software watches for it because attackers sometimes clear logs. For privacy on a shared PC, separate user accounts are the real answer; event logs mostly record system activity rather than what you did.

For the same reason, clearing logs before handing a PC to a repair shop removes the evidence they need. Leave logs intact, or save them, when asking someone else to diagnose a problem.

Malware and intruders sometimes clear logs to hide their tracks, which is why a 104 or 1102 event you did not cause is worth investigating: run a full Microsoft Defender scan and change important passwords if you find one you cannot explain.

Where log files are stored

Logs are stored as .evtx files in C:\Windows\System32\winevt\Logs. Do not delete these files directly; Windows keeps them open and deleting them can damage logging. Use Clear Log or wevtutil instead. If the folder seems large, check individual log sizes in their Properties and lower the maximum for any that are oversized. A few hundred megabytes in total is normal on a PC with many components.

On PCs with little free space, it can be tempting to delete large .evtx files. Lower the maximum size of that log in its Properties and clear it instead; Windows then trims the file safely.

Event Viewer will not open or logs are empty

• "MMC could not create the snap-in": run sfc /scannow in Terminal (Admin), then try again.
• Logs empty or not updating: open services.msc and check Windows Event Log is Running and Automatic. Without it, nothing is recorded.
• "The event log file is corrupted": save what you can, then clear that log; Windows recreates it.
• Very slow to open: one huge log, often a custom or Operational log set to a large size, slows Event Viewer down. Lower its maximum size.

If Event Viewer opens but shows "The data is invalid" for a log, that log's file is damaged; clearing it is the fix, after saving anything you can still read.

Does clearing logs speed up Windows?

No. Event logs are written in the background and capped in size; a full log does not slow Windows down. "PC cleaner" tools that clear logs as a speed boost offer no real benefit, and they remove the history you might need to diagnose a problem later. If your PC is slow, look at startup apps, disk space and Task Manager instead; our guides to Task Manager and finding what fills your storage are better starting points.

The same applies to clearing logs before selling or giving away a PC: it is not enough for privacy. Use Reset this PC with Remove everything, which removes logs along with your files and accounts.

Clearing logs on a schedule

There is no need to clear logs regularly, since the overwrite setting keeps them in check. If you have a reason, such as a test PC you reset weekly, create a Task Scheduler task that runs Terminal with the wevtutil loop as an administrator. Save logs first in the same task if you might need them, using wevtutil epl to a dated folder.

Test the task once manually from Task Scheduler and check that the logs actually cleared, since tasks that need administrator rights fail silently if Run with highest privileges is not checked.

Events worth paying attention to

• Kernel-Power 41: the PC restarted without shutting down cleanly, often heat, power or a crash. Our guide to a PC that shuts down after starting explains it.
• WHEA-Logger: hardware errors from CPU, memory or PCIe devices.
• Disk 7, 51, 153 or Ntfs errors: storage problems worth backing up for.
• BugCheck 1001: a blue screen occurred, with its stop code.
• Repeated application crashes (Application Error 1000) for the same app: update or reinstall it.
• WindowsUpdateClient errors: updates failing; see our guide to Windows Update connection errors.

When one of these appears together with a problem you notice, it is worth acting on. When it appears once, months ago, with no symptoms since, it is usually history rather than a warning.

Create a custom view for your problem

A custom view saves a filter across several logs. Click Create Custom View... in the Actions pane, choose a time range, levels, and either By log (for example System and Application) or By source, add event IDs if you know them, and name it, such as Crashes and restarts. It appears under Custom Views and updates live. A view for 41,1001,6008 plus WHEA-Logger events gives a one-click crash history, and a view for your printer's or Wi-Fi adapter's source shows only that device's events.

Custom views can be exported and imported as small XML files from the Actions pane, which is handy for setting up the same view on several family PCs or sharing it with someone helping you.

Windows Update logs

Update problems are recorded under Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational, with event 20 for installation failures and 19 for successes, including the KB number. For a detailed text log, run Get-WindowsUpdateLog in PowerShell, which writes WindowsUpdate.log to your desktop. Clearing these logs does not reset Windows Update; to fix update problems, reset the update components instead.

Look for patterns here too: the same KB number failing on several days points at one problem update, while many different failures at once point at the update system itself, such as a damaged cache, a proxy or a leftover policy.

Find out why an app keeps crashing

When an app closes suddenly, look in the Application log for Application Error 1000 at that time. The event names the app, its version, and the faulting module, which is often the real clue: a crash in a graphics driver file points to the driver, one in an add-in points to that add-in, and one in the app's own files suggests reinstalling or updating it. Windows Error Reporting 1001 events just after give a bucket ID that support teams can use.

If the faulting module is a system file such as ntdll.dll or KERNELBASE.dll, it is rarely Windows' fault; those files simply report the crash. Update or reinstall the app first.

Windows 10 differences

Event Viewer is the same on Windows 10 and 11: the same logs, IDs, Clear Log action and wevtutil commands. Windows 10 reached end of support in October 2025, but its logs still work for troubleshooting, and saved .evtx files open on either version.

The Windows 10 Settings app lacks some newer Windows 11 troubleshooters, which makes Event Viewer and Reliability Monitor even more useful there for spotting what failed and when.

Saved logs from either version can be opened on the other, so a Windows 10 PC's logs can be examined on a Windows 11 machine and vice versa.

A two-minute health check

Once a month or after anything odd, open Reliability Monitor and glance at the last few weeks. No red crosses means nothing needs attention. A cluster of red crosses on one day, or the same app failing repeatedly, is your cue to open Event Viewer, filter to that time and read the events. That small habit catches failing drives, bad updates and crashing apps early, without ever needing to clear a log.

Reliability Monitor also lists successful updates and app installs as blue information icons, so it doubles as a simple history of what changed on the PC and when.

Event logs and privacy on shared PCs

Event logs mostly record system activity: services, drivers, updates and sign-ins. They do not record the websites you visit, the documents you open or what you type. On a shared PC, the Security log does show who signed in and when, which administrators can read. If that matters, give each person their own account and keep administrator rights to trusted adults; standard users cannot read the Security log at all.

If you are worried about what an app records, check the app's own logs and privacy settings; Windows event logs are rarely where personal activity ends up.

Device and driver events

Every device in Device Manager has its own event history. Open Device Manager, right-click a device, choose Properties, and open the Events tab: it lists when the device was installed, configured, started or failed, with a View All Events button that opens the matching entries in Event Viewer. It is the fastest way to see whether a Wi-Fi adapter, printer or USB device has been resetting, and it pairs well with the clear-and-reproduce method when a device keeps disconnecting.

Seeing a device start and stop many times in an hour, with no matching action from you, usually means a loose cable, a power-saving setting or a failing USB port rather than a driver bug.

Sleep, wake and battery events

Power events tell you why a PC woke, slept or ran out of battery. In the System log, Kernel-Power 42 records entering sleep and Power-Troubleshooter 1 records waking, with the wake source. For laptops, powercfg /batteryreport and, on Modern Standby devices, powercfg /sleepstudy create readable reports from the same data, showing battery drain during sleep and which components kept the PC awake. These are more useful than clearing logs when battery life suddenly gets worse.

Clearing the System log erases this history too, so save it first if you are investigating battery or sleep problems over several days.

Turn on extra logs for a stubborn problem

Some useful logs are switched off by default to save space. For printing problems, the PrintService > Operational log, under Applications and Services Logs > Microsoft > Windows, records every print job and error once enabled: right-click it and choose Enable Log. The same works for other components with Operational logs, such as DNS Client Events for name-resolution problems. Enable the log, clear it, reproduce the problem, read what it captured, then disable it again when you are done. This targeted logging found the exact failure behind Ethan's father's disappearing printer.

Do event logs wear out an SSD?

No meaningful amount. Event logs write small amounts of data spread over the day, far less than ordinary browsing, updates and app caches. Disabling logging or clearing logs to protect an SSD gains nothing and removes your ability to diagnose problems. Modern SSDs are rated for many years of normal use including logging.

If you want to reduce writes on an older or small SSD, the bigger wins are elsewhere: Classic search indexing instead of Enhanced, browser cache settings, and keeping large downloads on another drive. Leave event logging alone; its cost is tiny and its value when something breaks is large.

View logs from another PC

Event Viewer can open the logs of another computer on your network: click Action > Connect to Another Computer... and enter its name, using an account that is an administrator there. The remote PC must allow remote event log management through its firewall. For a PC that will not start, boot it into the recovery environment, open Notepad from the Command Prompt, use File > Open to browse to C:\Windows\System32\winevt\Logs, and copy System.evtx and Application.evtx to a USB stick; open them on a working PC with Open Saved Log to see what happened before it failed.

For IT admins: event logs at scale

Retention. Set log sizes and retention by Group Policy (Computer Configuration > Administrative Templates > Windows Components > Event Log Service) or Intune, and forward important events to a SIEM or Windows Event Forwarding collector rather than relying on local logs.

Clearing. Alert on events 104 and 1102; unexpected log clearing is a common indicator of compromise. Restrict who can clear logs through user rights and audit policy.

Scripts. wevtutil epl with a query exports only relevant events, and Get-WinEvent -FilterHashtable pulls specific IDs across machines for troubleshooting.

Baselines. Keep a short list of known-noisy event IDs for your environment so technicians do not chase harmless entries during incidents.

Clearing Event Viewer: frequently asked questions

Ethan's father still opens Event Viewer now and then, but he no longer panics at red text. He knows most of it is the normal chatter of a busy operating system, and that the useful moments come when something specific goes wrong: save, clear, reproduce, read. That habit found his printer problem in two minutes after weeks of guessing. Clearing logs is a tool for focus, not a cure, and used that way it is one of the most powerful free troubleshooting tricks in Windows.

Revision note. Written October 2, 2026, rewriting our 2016 guide with safe clearing, saving and reading of Windows 11 event logs. May your logs always tell you what you need.