Windows event logs: why they grow large and how to manage them

Windows Event Logs record system events, errors, warnings, and application messages. By default they're capped at specific sizes, but older entries can accumulate across many logs.

Where event logs live

C:\Windows\System32\winevt\Logs\

Each .evtx file is a separate log channel. Common large ones:

• System.evtx
• Application.evtx
• Security.evtx
• Microsoft-Windows-Diagnostics-Performance%4Operational.evtx
• Microsoft-Windows-WMI-Activity%4Operational.evtx

Clearing logs

# Clear all event logs
Get-EventLog -List | ForEach-Object {{{ Clear-EventLog -LogName $_.Log }}}

# Or via wevtutil for specific logs
wevtutil cl System
wevtutil cl Application
wevtutil cl Security

Why it matters

Event log writes happen continuously in the background. On systems with many active services and verbose logging, this creates constant small disk writes. On HDDs this is audible. On SSDs it adds to write amplification over time.

Clearing logs periodically also speeds up Event Viewer — it doesn't have to parse thousands of old entries.

Log size limits

Right-click any log in Event Viewer → Properties → set Maximum log size. 20MB is sufficient for most use cases. The default for some logs is 1GB+.

IzanagiOP's Cleaner includes Event Viewer log clearing. The Aggressive pack also reduces log verbosity for non-critical channels. https://terweb.lt/