Where Are Windows Event Viewer Logs Stored?
Event Viewer logs live as .evtx files in System32 winevt Logs, one file per channel with registry tracked paths.
Last updated
Windows funnels system, security, and application events into per channel .evtx files under System32 winevt Logs. System.evtx, Security.evtx, and Application.evtx are the famous three, with hundreds of operational channels beside them using encoded names.
Paths are per channel settings, not folklore. The registry File value under each EventLog service key records the truth, and the Properties dialog surfaces it. Admin rights gate nearly everything here, from reading Security to clearing any channel at all.
Where Event Viewer stores this, by platform
%SystemRoot%\System32\winevt\Logs
One .evtx per channel. Copying live files fails under lock, so export with wevtutil. SysWOW64 never hosts these; System32 does on both bitnesses.
Frequently asked questions
How do I back up event logs safely?
Export with wevtutil epl to a target path instead of copying live files. The Event Log service locks open channels, so raw copies fail or truncate.
How do I confirm where one channel writes?
Right click the log, open Properties, and read the Log path field. Channels can move, so trust the dialog over memory of the default.
Can logs move off the system drive?
Yes in Properties or wevtutil sl with a new path, then fix SYSTEM and EventLog permissions to match the default folder. Restart if logs do not follow.
Notice an outdated path? Let us know.