Recipe 16.7. Clearing the Events in an Event Log


Problem

You want to clear all of the events in an event log.

Solution

Using a graphical user interface

  1. Open the Event Viewer (eventvwr.msc).

  2. In the left pane, right-click on the Target Event Log and select Clear all Events.

  3. You then have an option to save the log before clearing it. Click Yes to save it, or No to not save it.

Using a command-line interface

The following command clears an event log:

> wmic /node:"<ComputerName>" nteventlog where "Logfilename = '<LogName>'" Call ClearEventLog

Here is an example that clears the Application log on computer wks01:

> wmic /node:"wks01" nteventlog where "Logfilename = 'Application'" Call ClearEventLog

Using VBScript
' This code clears all events from the specified event log. ' ------ SCRIPT CONFIGURATION ------ strLog = "<LogName>"        ' e.g. Application strComputer = "<ComputerName>"  ' e.g. wks01 (use "." for local machine) ' ------ END CONFIGURATION --------- set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") set colLogs = objWMI.ExecQuery("Select * from Win32_NTEventlogFile Where " & _                                "Logfilename = '" & strLog & "'") if colLogs.Count <> 1 then    WScript.Echo "Fatal error.  Number of logs found: " & colLogs.Count    WScript.Quit end if for each objLog in colLogs    objLog.ClearEventLog    WScript.Echo strLog & " cleared" next

Discussion

Typically, you do not want to clear an event log unless you've backed up or archived the log. Clearing an event log without saving the events makes it very difficult to later track down and troubleshoot problems.

If you clear the Security event log, event 517 will be automatically generated in the Security log. This event indicates the log was cleared and is important from an auditing perspective. Without event 517, you wouldn't have an idea if the security log had previously been cleared. This doesn't occur for the other logs.

See Also

MS KB 315147, "HOW TO: Clear the Event Logs in Windows 2000"



Windows XP Cookbook
Windows XP Cookbook (Cookbooks)
ISBN: 0596007256
EAN: 2147483647
Year: 2006
Pages: 408

Similar book on Amazon

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net