Stop Event Logs from Filling Your System Drive

TL;DR

Find the offenders with **Get-WinEvent -ListLog**, set a size with **wevtutil sl <log> /ms:<bytes>**, and export important logs with **wevtutil epl** before they overwrite themselves.

Before you start

Requirements

Admin rights
A second drive for archives
20 minutes

Step by step

Instructions

Find the logs that actually use space

**Get-WinEvent -ListLog** returns the file size and the configured maximum per channel. Sorting by size turns a vague disk problem into a list of three or four names.

Get-WinEvent -ListLog * -ErrorAction SilentlyContinue |
  Sort-Object FileSize -Descending |
  Select-Object -First 10 LogName,FileSize,MaximumSizeInBytes,RecordCount,LogMode | Format-Table -AutoSize

tipChannels under **Microsoft-Windows-.../Debug** and **/Analytic** are usually disabled. Enabling one accidentally is a classic way to write gigabytes per hour.

Set a size that fits the disk

**MaximumSizeInBytes** is what the channel commits to on disk. A 1 GB limit per channel is generous for troubleshooting and absurd for 40 channels on a 128 GB drive.

wevtutil sl System /ms:134217728
wevtutil sl Application /ms:67108864
wevtutil gl System | Select-String 'maxSize|retention|channel'

Choose overwrite or archive on purpose

**retention: false** means circular logging, where the oldest records go first. **retention: true** stops at the limit and needs an archive step, which is what you want on a machine someone will investigate later.

wevtutil sl System /rt:false
wevtutil sl Application /rt:true
Get-WinEvent -ListLog System,Application,Security | Select-Object LogName,LogMode,MaximumSizeInBytes

⚠ warningAutomatic archiving only happens for logs with retention enabled and writes into **C:\Windows\System32\Winevt\Logs** by default. That folder grows instead — redirect or clean it.

Export before you clear anything

**wevtutil epl** writes a copy you can open on another machine. Clearing without an export destroys exactly the evidence you were trying to keep.

New-Item -ItemType Directory D:\LogArchives -Force | Out-Null
wevtutil epl System D:\LogArchives\System-$(Get-Date -f yyyyMMdd).evtx
wevtutil epl Application D:\LogArchives\Application-$(Get-Date -f yyyyMMdd).evtx
dir D:\LogArchives

Automate the rotation

A scheduled task keeps the archive current without a monthly reminder. The same command that clears a log can export it first.

schtasks /create /tn "RotateEventLogs" /tr "powershell -NoProfile -Command \"wevtutil epl System D:\LogArchives\System.evtx; wevtutil cl System\"" /sc weekly /d SUN /st 03:00 /ru SYSTEM /f
schtasks /query /tn "RotateEventLogs" /fo list

Prove the size dropped

Right after a clear the file shrinks but the channel keeps its configured maximum. Reading both values confirms the change is real and not a stale listing.

wevtutil cl System
Get-WinEvent -ListLog System | Select-Object LogName,FileSize,MaximumSizeInBytes,RecordCount
Get-ChildItem C:\Windows\System32\Winevt\Logs\*.evtx | Sort-Object Length -Descending | Select-Object -First 5 Name,Length

Troubleshooting

Common issues

A log refills within minutes

A driver or service is looping. Identify the source with the provider name in the newest records, then fix the component instead of enlarging the log.

wevtutil sl fails with access denied

The command needs an elevated prompt, and some channels are managed by a policy that overrides local settings.

Security log keeps stopping at its limit

That is by design with retention enabled. Point an archive task at it, or accept that older records overwrite.

The archive files will not open

An .evtx copied while the log service holds a handle can be truncated. Export with wevtutil epl instead of copying the file.

FAQ

Frequently asked

How large should the System log be?

Between 64 and 256 MB covers weeks of normal use on a desktop. Servers with chatty roles need more, and the number should come from the retention requirement, not from a default.

Does clearing the log hide a problem?

It removes the history. Export first, then clear, and keep the archive outside the system drive.

How to undo this

Set the previous size back with wevtutil sl <log> /ms:<old value> and the previous retention with /rt:true or /rt:false. Delete the scheduled task with schtasks /delete /tn RotateEventLogs /f.

Changelog · 1 entry

2026-10-31
First version

Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress