Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
FolderRisk: Caution

winevt C:\Windows\System32\winevt

C:\Windows\System32\winevt: container folder of the Windows Event Log service. The .evtx logs are in the Logs subfolder.

Updated on By AltF4 Formation

What it’s for

winevt is the anchor point of the Windows Event Log service (EventLog). It is mostly a container: the logs themselves are in the Logs subfolder.

What it contains

  • Logs, which holds the .evtx files: System, Security, Application, plus the “Applications and Services Logs” channels.

Risks and best practices

  • Files in use are locked by the EventLog service. Moving or deleting the folder by hand makes the service fail.
  • To relocate a log, change its path with wevtutil sl <log> /lfn:<path> (or the log’s File Registry value), not with File Explorer.
  • To clear a log, use Event Viewer or wevtutil cl, after a backup (wevtutil epl) if the log has audit value.

Useful commands

Fenêtre de terminal
# The largest logs, with their file
Get-WinEvent -ListLog * -ErrorAction SilentlyContinue | Sort-Object FileSize -Descending |
  Select-Object -First 10 LogName, FileSize, MaximumSizeInBytes, LogFilePath

Folder contents

Folders 1

Report a mistake