$_shellschool
…

wevtutil

Windows CMD · System · reference only

What it does

Queries, exports and manages Windows event logs from the command line.

Syntax

wevtutil orden [argumentos] [opciones]

Options and parameters

  • qe registro

    Queries events (query-events) from a log such as System or Application.

  • el

    Lists the available event logs (enum-logs).

  • gl registro

    Shows a log's configuration (get-log).

  • epl registro fichero

    Exports a log to an .evtx file (export-log).

  • cl registro

    Clears the events of a log (clear-log).

  • /c:N

    Maximum number of events returned.

  • /f:text

    Readable output format; also xml or rendered xml.

  • /rd:true

    Reads the most recent events first.

Usage examples

  • wevtutil qe System /c:3 /f:text

    Shows the first three events of the system log.

  • wevtutil el

    Lists the logs that can be queried.

  • wevtutil qe Application /c:5 /rd:true /f:text

    Shows the five most recent Application events.

  • wevtutil epl System sistema.evtx

    Exports the system log to a file.

Notes and common mistakes

  • To read the Security log you need an administrator console.
  • cl deletes the events irreversibly: export them first with epl.

Related commands