How to Use the wevtutil Command in Windows 11 to Query, Export, and Clear Windows Event Logs

Monitoring system stability, auditing authentication failures, and investigating security incidents across enterprise Windows 11 endpoints requires access to the Windows Event Log infrastructure. While the graphical Event Viewer snap-in (eventvwr.msc) is familiar to administrators, it can freeze or become unresponsive when rendering multi-gigabyte log files containing hundreds of thousands of events, and it cannot be automated across remote deployment scripts or incident response triage workflows.

For scriptable, high-speed log management, Windows 11 provides the Windows Event Log Utility: wevtutil.exe. Operating directly against the modern XML-based Event Log architecture (EVTX), wevtutil enables systems engineers and security analysts to query live event feeds using XPath 1.0 filters, archive logs to standalone files, inspect log provider configurations, adjust maximum file sizes, and purge obsolete event channels. This technical guide explores wevtutil syntax, practical forensic XPath queries, automated export scripts, and log channel configuration.

Essential wevtutil Command Operations Reference

All wevtutil commands require an elevated Administrator terminal prompt:

Sub-Command	Primary Function	Example Use Case
qe (query-events)	Queries and retrieves events from a log channel or saved EVTX file.	Extracting specific event IDs (e.g., failed logons) directly to the console.
epl (export-log)	Exports events from an active channel to an offline .evtx archive.	Forensic evidence collection during an incident response investigation.
cl (clear-log)	Purges all events from a designated log channel.	Clearing bloated application logs after resolving recurring errors.
gl (get-log)	Displays configuration parameters (size, retention policy, enabled status) for a channel.	Auditing maximum log buffer sizes on critical domain controllers or servers.
sl (set-log)	Modifies log configuration parameters (e.g., maximum buffer size in bytes).	Increasing Security log size to prevent event overwriting.

Step 1: Listing and Enumerating Available Log Channels

Modern Windows operating systems host hundreds of granular application and service channels beyond the classic Application, Security, and System logs:

Listing All Active Log Channels

wevtutil enum-logs

To count or filter specific channels (e.g., PowerShell operational logs):

wevtutil enum-logs | findstr /i "PowerShell"

Step 2: Querying Events with XPath Filters (qe)

The qe command reads event channels. By default, it outputs verbose XML. Use flags to format text output and limit record count:

Querying the 5 Most Recent System Errors

wevtutil qe System "/q:*[System[(Level=2)]]" /c:5 /rd:true /f:text

Parameter breakdown:

• /q:... — Specifies the XPath query filter (Level=2 corresponds to Error; Level=1 is Critical; Level=3 is Warning).
• /c:5 — Limits the output to 5 records.
• /rd:true — Reads events in reverse chronological order (newest first).
• /f:text — Formats the event as human-readable plain text rather than raw XML.

Auditing Failed Logon Attempts (Event ID 4625)

To query the Security log for failed user logon attempts within the last 24 hours:

wevtutil qe Security "/q:*[System[(EventID=4625)]]" /c:10 /rd:true /f:text

Step 3: Exporting Logs for Offline Forensic Triage (epl)

During security incident response or compliance auditing, archiving raw event logs preserves tamper-evident evidence without disrupting live system monitoring:

Archiving the Complete Security Channel

wevtutil epl Security "C:\Forensics\Security_Archive.evtx"

Exporting Filtered Events to an EVTX Archive

To export only Error and Critical events from the System channel into a compressed diagnostic container:

wevtutil epl System "C:\Forensics\System_Errors.evtx" "/q:*[System[(Level=1 or Level=2)]]"

Step 4: Configuring Log Buffer Sizes and Retention (sl)

By default, the Windows Security log is capped at 20 MB, which can overwrite crucial audit history in active multi-user environments within hours:

Auditing Current Log Configuration

wevtutil gl Security

Inspect the maxSize value (measured in bytes) and the retention policy.

Increasing Maximum Log Size to 500 MB

wevtutil sl Security /ms:524288000

Calculation: 500 MB × 1024 × 1024 = 524,288,000 bytes.

Enabling an Inactive Operational Channel

Many specialized operational logs (such as Windows Defender or AppLocker scripts) are disabled by default. To enable them:

wevtutil sl "Microsoft-Windows-Windows Defender/Operational" /e:true

Step 5: Clearing Logs Safely with Automated Backup (cl)

To purge log channels while maintaining an immutable archival backup:

wevtutil cl Application /bu:"C:\Backups\Application_PriorToReset.evtx"

The /bu (backup) parameter guarantees that wevtutil flushes all existing records to disk before wiping the active channel buffer.

Operational Best Practices and Security Monitoring

• SIEM Detection of Event Log Clears: Clearing the Security log automatically generates Event ID 1102 (“The audit log was cleared”). Enterprise security information and event management (SIEM) systems treat Event ID 1102 as a high-severity alert indicating potential attacker anti-forensic activity. Only execute wevtutil cl during sanctioned maintenance windows.
• Querying Offline EVTX Files: The qe command can parse offline files collected from other endpoints:

  wevtutil qe "C:\Forensics\RemoteServer.evtx" /lf:true /f:text

  The /lf:true (log-file) flag instructs the utility to query an archived file rather than a live local channel.