Clear all event logs in 'Ecent Viewer' . Question.

@Brink


Running 21H2 19044. 1415


A quick question for anyone who may care to reply.


To 'Clear all event logs in 'Events Vewier', I have always used the following in an Admin. Command Prompt...


for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"


It has always worked perfectly, until today.

I noticed this morning, that there was a 'RED' event showing for yesterday. Nothing serious, only that 'Malwarebytes Tray Application, had stopped working'.

I've seen this a time or two before, no biggie. And ran the above command to remove it.

However, this time, after three (3) runs, including a reboot after the second run, it is still there. Of course, everything else is cleared. But not this one item.

Anyone ever seen this behavior before? I know it's nothing serious, but it bugs the devil out of me, not to be able to remove it.

Any advice, would be much appreciated.


Thank you, WXC.

Hello WXC,

Have you tried the other methods? Clear All Event Logs in Event Viewer in Windows

steve108 said:

Hello WXC,

Have you tried the other methods? Clear All Event Logs in Event Viewer in Windows

Hey, buddy.

No, I haven't. will give it a shot though.

Thank you. Hope all has been good for you and yours.

WXC said:

Hey, buddy.

No, I haven't. will give it a shot though.

Thank you. Hope all has been good for you and yours.

Thanks and wish you and yours the same.

I've never tried/bothered clearing the Event Log. Lets me be able to check if an error I see used to happen in the past or not if it's still in the log. Came in handy when I was able to confirm crap Comodo Firewall I test installed was causing errors in the log that were never there in past months and started after I uninstalled it.

What are the benefits for you other then saving disk space and getting rid of those pesky red errors?

steve108 said:

Thanks and wish you and yours the same.

I've never tried/bothered clearing the Event Log. Lets me be able to check if an error I see used to happen in the past or not if it's still in the log. Came in handy when I was able to confirm crap Comodo Firewall I test installed was causing errors in the log that were never there in past months and started after I uninstalled it.

What are the benefits for you other then saving disk space and getting rid of those pesky red errors?

Thank you.


Honestly, no benefit at all. It just bothers me, to see an event, and not be able to clear it. Yes, I know it's crazy.


By the way, I ran 3 different commands, in Admin Power Shell..... twice.

And still no luck in clearing it (the one event).


No biggie, but it's just weird.

WXC said:

Thank you.


Honestly, no benefit at all. It just bothers me, to see an event, and not be able to clear it. Yes, I know it's crazy.


By the way, I ran 3 different commands, in Admin Power Shell..... twice.

And still no luck in clearing it (the one event).


No biggie, but it's just weird.

Thanks for the update.

Hmmm, consider reporting this in that tutorial thread so our alien chief in charge may see it and respond

steve108 said:

Thanks for the update.

Hmmm, consider reporting this in that tutorial thread so our alien chief in charge may see it and respond

Yeah, I really didn't want to bother Brink. But I'll bring it to his attention in the existing thread.

Perhaps it will be of benefit to others.

Thank you, Steve.

I just stop Event Log service and clean logs manually.

Code:

net stop EventLog /y
del "%WINDIR%\System32\LogFiles" /s /f /q
del "%WINDIR%\System32\winevt\Logs" /s /f /q
del "%WINDIR%\System32\LogFiles" /s /f /q
del "%WINDIR%\System32\winevt\Logs" /s /f /q

TairikuOkami said:

I just stop Event Log service and clean logs manually.

Code:

net stop EventLog /y
del "%WINDIR%\System32\LogFiles" /s /f /q
del "%WINDIR%\System32\winevt\Logs" /s /f /q
del "%WINDIR%\System32\LogFiles" /s /f /q
del "%WINDIR%\System32\winevt\Logs" /s /f /q

Thank you,

Tried it. Still no luck.

I appreciate the effort, TO.

I'm going to give it a rest for now, as I know it's nothing serious.




- - - Updated - - -

Update...

I ran the inital command in Admin Command Prompt, again.

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"


Checked and the one event was still there. So, once again I rebooted, and upon checking, it was removed.

Don't know what the glitch was, but it is resolved now.

I'm sorry to have bothered you guys. (Reps on the way)

Considering it's for MBAM, the event is most likely protected and will not be allowed access to delete.