5

I am developing an application that creates Windows event logs and writes to them.

However, during development and testing, I created some event logs by mistake, with sources registered to them.

The issue is that only the first 8 characters of the event log name are significant. Now that I have logs with incorrect names, I cannot create the new logs that I need.

Is there any way to totally remove these event logs (and not just clear them)?

I have tried to delete the file C:\Windows\System32\winevt\Logs\WrongNamedEventLog.evtx, but with no success.

2
  • any final solution with full source code sample? maybe C# and Powershell and/or BAT-CMD scripts?
    – Kiquenet
    Jun 5, 2014 at 6:47
  • @Kiquenet See Powershell example in my answer, updated Jan 7, 2015 at 13:15

2 Answers 2

9

Do it programmatically, like this (C#):

System.Diagnostics.EventLog.Delete("WrongNamedEventLog");

You don't have to compile a C# application to do it though, just invoke the Delete(string logname) method from PowerShell if you like:

[System.Diagnostics.EventLog]::Delete("WrongNamedEventLog");
2
  • Thanks. There no other way, to just delete it somehow from Windows Administrator UI?
    – bzamfir
    Mar 12, 2012 at 7:40
  • Not AFAIK. Probably to avoid any accidental deletion of logfiles Mar 12, 2012 at 8:04
1

I haven't tested this, but if I was in your case...
Use regedit to browse this path, and delete your custom bogus logs:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\LogToDelete
Reboot
Then delete the corresponding files from:
C:\Windows\System32\winevt\Logs
and/or
C:\windows\system32\config

1
  • Thanks. I'll test. However, it would be nice if reboot wasn't involved... :)
    – bzamfir
    Mar 14, 2012 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .