How to clear a event log in Powershell 7

Question

in Powershell 5 we can clear a Windows-Event-Log in this way:

Get-EventLog -LogName * | % { Clear-EventLog -LogName $_.log }

how to do this in Powershell 7??? (using powershell only)

Powershell way of handling windows events is now with Get-WinEvent
but it appears no Clear-WinEvent is available

of course we can do this with wevtutil.exe
or even brute-forcing the logs file deletion after stopping the service...
but i'm asking only with native powershell code.

according to the MSDocs site, that cmdlet does NOT exist in ps7+. >>> Clear-EventLog (Microsoft.PowerShell.Management) - PowerShell | Microsoft Docs — learn.microsoft.com/en-us/powershell/module/… — Lee_Dailey
– Lee_Dailey, Commented Feb 2, 2021 at 15:01
yes... I noticed that... ;-) anyway it should now be "CLEAR-WINEVENT' for coherence with the evolution that is beeing done in powershell... — ZEE
– ZEE, Commented Feb 2, 2021 at 16:01
CLEAR-EVENTLOG was the companion of the deprecated GET-EVENTLOG.... so... thw new should be named CLEAR-WINEVENT for coherence with GET-WINEVENT... I hope it is clear enough. — ZEE
– ZEE, Commented Feb 2, 2021 at 16:03
Get-Command *winevent* on Posh 7.0.3 returns only Get-WinEvent and New-WinEvent. For PowerShell 5.1 it's the same. Seems like they are not supposed to be deleted or someone just forgot half of the features ;) — T-Me
– T-Me, Commented Feb 2, 2021 at 16:09

G42 · Accepted Answer · 2021-02-03 00:08:25Z

3

Well this is interesting. Clear-WinEvent indeed is not part of PowerShell 7. There was an issue raised to get it added but doesn't like that's going anywhere without more action.

The Microsoft approved way to do this is:

Import-Module Microsoft.PowerShell.Management -UseWindowsPowerShell
Get-EventLog -LogName * | % { Clear-EventLog -LogName $_.log }

This spins up a Windows PowerShell 5.1 process that runs in the background and invokes the Cmdlet via implicit remoting... not the best.

A better way would be to leverage the .NET EventLogSession.ClearLog method:

Get-WinEvent -ListLog * | foreach {
    [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName)
}

Aside - PowerShell 7 module compatibility lists the Microsoft.PowerShell.Management module (that Get-EventLog and Clear-EventLog are part of) as 'Built into PowerShell 7'

answered Feb 3, 2021 at 0:08

G42

10.1k2 gold badges22 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

ZEE Over a year ago

yes... and I've been using .net Eventing to acomplish the objective... but it seams to me that a CLEAR-WINEVENT sould already be available... even if now a CLEAR-LINUXEVENT or even a CLEAR-OSXEVENT can appear in the scene with the Powershell avaailability to other OS(s)...

G42 Over a year ago

@ZEE - this question seems to be less "How to clear a event log in Powershell 7" and more "Why is there no Clear-Event command in Powershell 7"... as per linked issue the Clear-EventLog was based on a proprietary API. I agree it should exist from a PS 5.1 feature-parity POV, but not from the POV of going from Windows PS 5.1 to open-source PS 7, based PS 6, in which *-EventLog cmdlets where removed

spottedmahn Over a year ago

"The Microsoft approved way to do this is" can you source that? I'd love to read more, thanks

Collectives™ on Stack Overflow

How to clear a event log in Powershell 7

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related