How to Use the wevtutil Command in Windows 11 to Query, Export, and Clear Event Logs

The Windows Event Viewer GUI provides an intuitive interface for inspecting system crashes, driver errors, and security audits. However, navigating through thousands of records across hundreds of custom logs becomes slow and inefficient during automated troubleshooting or incident response. Windows 11 includes wevtutil.exe (Windows Event Utility), a native command-line tool designed to query, export, configure, archive, and clear Windows event logs directly from PowerShell or Command Prompt.

Launching the Command Line with Administrative Privileges

Managing security logs, adjusting log file size allocations, or exporting audit channels requires elevated permissions. Before running wevtutil commands:

1. Press Win + X or right-click the Start button.
2. Select Terminal (Admin) or PowerShell (Admin).
3. Accept the User Account Control (UAC) prompt to proceed.

Enumerating Available Event Logs and Providers

Windows 11 maintains hundreds of individual event channels beyond the familiar Application, Security, and System logs. To list all active and registered event logs on the workstation, use:

wevtutil enum-logs

Because the list contains hundreds of channels, filter specific components using PowerShell’s Select-String:

wevtutil enum-logs | Select-String "Hyper-V|BitLocker|Defender"

To inspect the technical configuration, file path, current size, and retention settings of a specific log (such as the System channel), run:

wevtutil get-log System

Querying Events with XPath and Formatting Filters

The query-events (or qe) subcommand retrieves event records from any log channel. By default, querying outputs raw XML records. To read events in a human-friendly format, specify the /f:text parameter.

To view the 5 most recent events recorded in the System log:

wevtutil qe System /c:5 /rd:true /f:text

Parameter breakdown:

• /c:5: Limits output to a count of 5 events.
• /rd:true: Reverses the direction to retrieve the newest events first.
• /f:text: Formats the output as structured plain text rather than raw XML.

To filter for specific Event IDs—such as identifying system reboot and shutdown events (Event ID 6006 and 6008)—use an XPath query:

wevtutil qe System "/q:*[System[(EventID=6006 or EventID=6008)]]" /c:10 /rd:true /f:text

Exporting and Archiving Event Logs to EVTX Files

When collecting logs for forensic review or off-system diagnostics, the export-log (or epl) subcommand copies events into a standalone .evtx file without altering the active operational log:

wevtutil epl System C:\Logs\System_Export.evtx

You can also export only a filtered subset of events. For instance, to export only Critical (Level 1) and Error (Level 2) events from the Application log:

wevtutil epl Application C:\Logs\App_Errors.evtx "/q:*[System[(Level=1 or Level=2)]]"

Configuring Maximum Log Sizes and Retention Policies

Default log allocations may wrap around and overwrite older entries during heavy audit cycles. The set-log (or sl) subcommand configures storage quotas and behavior. File sizes are declared in bytes.

To increase the Security log size to 100 MB (104,857,600 bytes):

wevtutil sl Security /ms:104857600

To enable auto-archiving when full rather than overwriting events:

wevtutil sl Security /ab:true

Safely Clearing Logs with Mandatory Backups

When preparing a clean environment or resetting troubleshooting baseline traces, you can clear log channels using clear-log (or cl). To ensure critical audit data is never lost, wevtutil allows you to create an automatic backup archive simultaneously using the /bu switch:

wevtutil cl Application /bu:C:\Logs\Application_Archive_$(Get-Date -Format yyyyMMdd).evtx

The command writes all current events to the archive path before purging the active channel.

Essential wevtutil Command Reference

Command Syntax	Operation Performed
wevtutil enum-logs	Lists all registered event log channels on the system.
wevtutil get-log [LogName]	Displays status, file size, limits, and configuration of a log.
wevtutil qe [Log] /c:N /rd:true /f:text	Queries the latest N events from a log in formatted text.
wevtutil qe [Log] "/q:[XPath]" /f:text	Filters events using structured XPath queries.
wevtutil epl [Log] [OutFile.evtx]	Exports complete log channel to an EVTX file.
wevtutil sl [Log] /ms:[SizeBytes]	Configures the maximum file size quota in bytes.
wevtutil cl [Log] /bu:[Backup.evtx]	Backs up and purges all events from a specified log.