How to Export, Clear, and Increase the Size of Windows Event Logs in 2026

Windows Event Viewer is logging everything happening on your PC, but those logs fill up fast, slow down Event Viewer, and can start dropping events when they hit their size limit. Here’s how to export, clear, and resize event logs on Windows 10 and 11, using both the GUI and PowerShell.

How to Export a Windows Event Log

Export a log before you clear it. The .evtx format is the only type you can re-import into Event Viewer later. Use .csv or .xml if you want to open the data in Excel or a script instead.

Method 1: Export via Event Viewer (GUI)

1. Press the Windows key, type Event Viewer, and select the app.
2. In the left pane, expand Windows Logs.
3. Click the log you want to export, for example Application or System.
4. In the Actions pane on the right, click Save All Events As…

5. In the Save As dialog, navigate to where you want to save the file.
6. Enter a file name and set Save as type to Event Files (*.evtx) if you want to re-open it in Event Viewer later.
7. Click Save.

8. If prompted by the Display Information dialog, select Display information for these languages and click OK. This embeds locale metadata so the log renders correctly on another PC.

A metadata folder is saved alongside your .evtx file. If you’re sending the log to someone else, include that folder too.

Method 2: Export via PowerShell (faster for multiple logs)

Open PowerShell as Administrator, then run:

wevtutil epl Application "C:\Logs\Application.evtx"
wevtutil epl System "C:\Logs\System.evtx"
wevtutil epl Security "C:\Logs\Security.evtx"

This exports full .evtx files in seconds. If you’d rather export to CSV for analysis in Excel or a script, use Get-WinEvent:

Get-WinEvent -LogName Application `
  -FilterXPath "*[System[(Level=1 or Level=2 or Level=3)]]" |
  Export-Csv "C:\Logs\application_logs.csv" -NoTypeInformation

Swap Application for System or Security to export those logs. The Level filter limits output to critical, error, and warning events. Remove it if you want everything.

How to Open a Saved Event Log

1. Open Event Viewer.
2. In the menu bar, click Action > Open Saved Log…
3. Browse to your .evtx file, select it, and click Open.

The imported log appears under Saved Logs in the left pane.

How to Clear a Windows Event Log

Clearing a log requires administrator rights. In regulated or domain environments, the clear action itself gets recorded as a security event, so export first if there’s any chance you’ll need the data.

Method 1: Clear via Event Viewer (GUI)

1. Open Event Viewer and expand Windows Logs.
2. Right-click the log you want to clear (e.g., Application) and select Clear Log…

3. Choose one of the following:
   • Save and Clear: exports the log first, then clears it (recommended).
   • Clear: deletes all events immediately without saving.

Method 2: Clear via PowerShell

wevtutil cl Application
wevtutil cl System
wevtutil cl Security

Or using the classic cmdlet:

Clear-EventLog -LogName Application

Run PowerShell as Administrator, or the command will fail silently.

How to Increase the Maximum Size of an Event Log

If you’re seeing a message that an event log is full, or if logs are overwriting events faster than you can review them, increase the maximum log size.

Method 1: Change log size via Event Viewer (GUI)

1. Open Event Viewer and expand Windows Logs.
2. Right-click the log you want to resize and select Properties.

3. In the Log Properties dialog, find the Maximum log size (KB) field. You can set any value between 1,024 KB and 2,147,483,647 KB (~2 TB) in multiples of 64 KB.
4. Under When maximum event log size is reached, choose a retention behavior:
   • Overwrite events as needed (oldest events first): the default rolling log. Good for most personal PCs.
   • Archive the log when full, do not overwrite events: creates a new archive file when the log fills up. Good for keeping history without manual intervention.
   • Do not overwrite events (Clear log manually): stops logging entirely when full. Use only if you need strict audit control and will monitor the log actively.
5. Click OK to apply.

Method 2: Change log size via Group Policy (domain environments)

If you manage multiple machines, set log sizes centrally via Group Policy:

Computer Configuration → Administrative Templates → Windows Components → Event Log Service

Each log (Application, Security, System) has its own size and retention setting here. Changes apply at the next Group Policy refresh.

Troubleshooting Common Event Log Issues

Security log won’t go above a certain size

A domain Group Policy may be enforcing a smaller maximum. Check with your domain admin or look in Group Policy under Computer Configuration → Administrative Templates → Windows Components → Event Log Service → Security. If a GPO is setting a lower cap, it will override whatever you set locally.

Exported .evtx file looks corrupted or timestamps are wrong

Open the file directly in Event Viewer to validate it. Event Viewer renders .evtx correctly even when third-party tools misinterpret the format. If the file looks fine in Event Viewer, the issue is with the tool you’re using to parse it, not the export itself.

Can’t access Security log, permission denied

Non-administrator accounts can’t read the Security log by default. Add the account to the Event Log Readers local group (Computer Management > Local Users and Groups > Groups) to grant read access without full admin rights.

Event Viewer is slow to open a large log

Use Filter Current Log… in the Actions pane to narrow down by event level or time range before the full list renders. Alternatively, pull just the events you need with Get-WinEvent and review the output in a CSV.

Conclusion

For most people, the GUI method in Event Viewer is all you need. Export to .evtx, clear, and bump the size limit if logs are rolling over too fast. If you’re managing more than one machine or want to automate log rotation, wevtutil and Get-WinEvent are worth the small learning curve. One honest warning: if your Security log is filling up unusually fast, that’s worth investigating before you just increase the size. High audit volume can be a sign of a misconfigured policy or something unexpected running on the system.