Event Viewer And Logs, When To Clear

Something that I do on as part of my maintenance schedule is to clear the Event Viewer logs.

Windows has a nice tool for diagnostics if you can decode the somewhat cryptic message that is written to the log when your computer or Operating System has a problem.

Note: You can always do a search on technet.microsoft.com for the error if it is so cryptic that you don't know or understand what the error is telling you.

Prior to Windows Vista the event logs were easy to find and easy to read, then with Vista MS decided to change the lay out, as with all changes is more better? Actually in my opinion the larger format is a waste of video real-estate. It may look pretty but the functionality of the new event viewer has decreased.

The older event viewer had it's draw backs but when you viewed the event it didn't take up half the screen and when you have a large monitor that monstrosity in Vista/ Win7/ 8 /10 is huge! If you have another program or window open and want to view the two side by side you have to resize the event window. Then when you close it the darn thing doesn't retain the resize. You get that half a screen window again when you open it. Sheesh...

Why would you clear the event logs when if you have them set at the default settings of 512K? When the log reaches the maximum size it will start deleting the older entries when a new event is logged.

The old entries will take up some CPU and hard drive time but it isn't enough to worry about unless your computer/OS is having a problem and it is getting reported in the logs.

Clearing the log will cut down on the CPU and hard drive time but the log will fill up again in a short period of time unless you correct the problem that is filling up the event log.

What Systems Admins do when they install the OS is increase the log size from the default to 16384k. This larger size will have a longer period of time for the log this allows a search back to find when a certain event first occurred. This is very useful in diagnostics because the event may not be the cause but the result of a previous problem.

Troubleshoot, repair, maintain, upgrade & secure...     With this!

If you feel you need to clear the logs and the computer is under warrantee you should save the logs in case they are needed to fix a problem.

If you have a problem and have fixed it you may want to clear the log before restarting the computer, this will give you a clean log on restart making it easier to find any error events.

During normal operation the log will get to the maximum of the default setting in about a month and most if not all the entries will be of the 'Information' type, clearing the log is ok, a clean log will take up less CPU and hard drive time.

Do you know where the logs are and how to clear them?

I learned a long time ago that you should check these logs at least once a week, simple enough to do, just scroll through them looking for any error events.

Just part of maintaining a computer for the maximum performance...

P.S.

A "Best Practice" is to view the logs once a week, you may find a problem before it becomes a catastrophic failure...