Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. System.evtx
LogRisk: Caution

System.evtx C:\Windows\System32\winevt\Logs\System.evtx

System log: events from the kernel, drivers and Windows services, viewed in Event Viewer.

Updated on By AltF4 Formation

What it’s for

System.evtx records what Windows components report: startup and shutdown, drivers, services, hardware, disk, network. It is the first log to open after an unexpected restart, a blue screen or a service that goes down. For what all .evtx files have in common (locking, size, export), see the winevt\Logs folder page.

What it contains

  • Shutdowns and restarts: 41 (Kernel-Power, restart without a clean shutdown), 6008 (previous shutdown was unexpected), 1074 (shutdown requested, with process and user), 6005 and 6006 (event log service start and stop).
  • Blue screens: 1001 (BugCheck).
  • Services: 7036 (state change), 7034 (unexpected termination), 7045 (new service installed, worth watching for security).
  • Driver and disk errors (sources disk, Ntfs, storahci).
  • 104: a log was cleared.

Risks and best practices

  • Do not delete the file: the EventLog service locks it, and its history is what you diagnose with.
  • For a failure, start from the time of the 41 or 6008, then read the events from the minutes before: the cause is often there (disk, driver, power).
  • Export the log before clearing it. A 104 leaves a trace, but not the content that was lost.
  • On a client machine the default maximum size is 20 MB, and old events are overwritten. Raise it, or centralize the logs, if you want history.

Useful commands

Fenêtre de terminal
# Unexpected shutdowns, requested shutdowns and blue screens
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,6008,1074,1001} -MaxEvents 20 | Select-Object TimeCreated, Id, Message


# Errors from the last 24 hours
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddDays(-1)}


# Newly installed services
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} -MaxEvents 10 | Select-Object TimeCreated, Message


# Back up the log, then clear it (as administrator)
wevtutil cl System /bu:"$env:USERPROFILE\Desktop\System-before-clear.evtx"

Format

Binary XML file (.evtx) managed by the Windows Event Log service. Each event carries an ID, a level (Information, Warning, Error, Critical), a source, a timestamp and a message.

Rotation and archiving

Maximum size and retention rule (overwrite old events, archive, do not overwrite) are set in the log properties or through Group Policy. wevtutil gl System shows the current values. Archive by exporting with wevtutil epl or from Event Viewer.

How to read it

Event Viewer > Windows Logs > System. Filter by level, source or ID. For an .evtx copied from another machine, use Open Saved Log or Get-WinEvent -Path.

Report a mistake