Where Are Windows Event Logs Stored?
Windows stores system, security, and app events as .evtx files in the winevt Logs folder under System32.
Last updated
Windows records system, security, setup, and application events as .evtx files in System32/winevt/Logs: Application.evtx, System.evtx, Security.evtx, and per-provider channels beside them. Event Viewer reads this folder live.
Direct copies work when nothing holds locks, but exports are cleaner for sharing. Clearing is all-or-nothing per log, so archive first when the history matters for audits. Forwarded events land in their own channel logs.
Where Windows Event Logs stores this, by platform
%SystemRoot%\System32\winevt\Logs
Application, System, Security, and channel .evtx files. Read live in Event Viewer; export views for portable copies. Clearing needs elevation.
Frequently asked questions
How do I back up Windows Event Logs?
Copy the .evtx files with Event Viewer closed, or export filtered views to .evtx from inside Event Viewer. The exports open on any Windows machine.
How do I clear Windows Event Logs?
Open Event Viewer and clear per log, or use wevtutil cl commands in an elevated prompt. Clearing needs admin rights and cannot target single events.
Notice an outdated path? Let us know.