Have used the useful script many times.
There are 5 types of Events - Critical/ Error/ Warning/ Information/ Audit Success
Any method that we can retain, say, Critical and, maybe, Error, that are crucial for diagnosing problems in future, and can delete rest of the types that are informative?
How can we just stop Audit success type of events from getting recorded in event logs?
Thanks.
--
First of all, thanks for the great batch files. Just wanted to add a VBS version that I created to do the same in case anyone was interested in it.
Please note, this does not have any checking for Admin rights, but that is since I usually have these running via a Software Delivery System (MDT, SCCM, etc) or are part of my MDT Applications.
Code:On Error Resume Next 'Define and configure objects Set WshShell = CreateObject("WScript.Shell") Set WshShellExec = WshShell.Exec("%ComSpec% /C WEvtUtil.exe EL") WshShellExecOutPut = WshShellExec.StdOut.ReadAll 'Read each line and clear the event logs For Each EventLog in Split (WshShellExecOutPut, VBNewLine) WScript.Echo "Clearing: " & EventLog WshShell.Run "WEvtUtil.exe CL " & EventLog, 0, TRUE Next
Hello Mirfster, and welcome to Seven Forums.
No problem. Here's your .vbs with a UAC prompt for elevation added to it. :)
Code:'UAC prompt for elevation If WScript.Arguments.Count = 0 Then Set objShell = CreateObject("Shell.Application") objShell.ShellExecute "wscript.exe", Chr(34) & WScript.ScriptFullName & Chr(34) & " Run", , "runas", 1 Else On Error Resume Next 'Define and configure objects Set WshShell = CreateObject("WScript.Shell") Set WshShellExec = WshShell.Exec("%ComSpec% /C WEvtUtil.exe EL") WshShellExecOutPut = WshShellExec.StdOut.ReadAll 'Read each line and clear the event logs For Each EventLog in Split (WshShellExecOutPut, VBNewLine) WScript.Echo "Clearing: " & EventLog WshShell.Run "WEvtUtil.exe CL " & EventLog, 0, TRUE Next End If
Last edited by Brink; 12 Dec 2012 at 13:17. Reason: highlight
You're welcome.
I'd recommend to remove the line below to not have to click on OK for each log cleared. Only a few million of them.
Code:WScript.Echo "Clearing: " & EventLog
Maybe this instead:
Code:'UAC prompt for elevation If WScript.Arguments.Count = 0 Then Set objShell = CreateObject("Shell.Application") objShell.ShellExecute "wscript.exe", Chr(34) & WScript.ScriptFullName & Chr(34) & " Run", , "runas", 1 Else On Error Resume Next 'Define and configure objects Set WshShell = CreateObject("WScript.Shell") Set WshShellExec = WshShell.Exec("%ComSpec% /C WEvtUtil.exe EL") WshShellExecOutPut = WshShellExec.StdOut.ReadAll 'Read each line and clear the event logs For Each EventLog in Split (WshShellExecOutPut, VBNewLine) WshShell.Run "WEvtUtil.exe CL " & EventLog, 0, TRUE Next End If MsgBox "Event Viewer logs have been successfully cleared."
Actually, I just left that in there so that when it is being ran via "CScript.exe" it shows progress. The code I provided is actually a snippet from my VBS that I use to prepare my base image.
I see what you mean though if it were to be launched via "WScript.exe".
Hello Rockit,
Either option in the tutorial does the same thing. It's just a matter of which one you would like to use. :)
Great tool, thanks very much. I've become a bit OCD about no errors on boot up, so this really comes in handy :)
Quote