The Windows Event logs provide very valuable information for diagnosing problems on the computer. Event logs store records of significant events on behalf of the system and applications running on the system.
This article tells you how to export the event logs to a file using the Event Viewer or the wevtutil console tool. The exported .evtx log can be sent to a support technician for diagnosis.
Export Windows Event Logs
To export the event logs to a file, follow one of the methods below.
Option 1: Using the Event Viewer
- Start the Event Viewer. To do so, right-click Start, click Run, type eventvwr.msc and click OK.
- The standard logs are “Application”, “Security”, and “System” which are listed under “Windows logs”. There are also other logs under a separate section named “Applications and Services Logs”. Select the log you want to export. For example, expand Windows Logs, and select System.
- Right-click on the log and click “Save All Events As…“.
- Select the folder location where you want to save the .evtx file.
- If you’re exporting the log from a system that uses a non-English locale, select “English (United States)” from the languages list in the “Display Information” dialog. When you use this option, a subdirectory (“
LocaleMetaData“) is created in the destination folder and all locale-specific information is saved in that subdirectory.
- Click OK.
LocaleMetaData folder) and send the zip archive.
Option 2: Using Wevtutil.exe command-line
The built-in wevtutil.exe console tool can be used to export event logs.
For example, to export “Application”, “Security”, and “System” logs to a folder (e.g., D:\Temp), run the following commands from an admin Command Prompt window:
wevtutil epl Application D:\temp\application.evtx
wevtutil epl Security D:\temp\security.evtx
wevtutil epl System D:\temp\system.evtx
Exporting a log under “Application and Services Logs”
To export the “AppReadiness/Admin” log under the “Application and Services Logs” node, run:
wevtutil epl "Microsoft-Windows-AppReadiness/Admin" D:\temp\appreadiness-admin.evtx
The log name in the above example is “Microsoft-Windows-AppReadiness/Admin“. The list of event logs can be obtained by running the command wevtutil el. If a log name contains spaces, enclose the log name within double-quotes when running the wevtutil.exe command-line.
Note: There doesn’t seem to be a way to export local information when exporting the logs using wevtutil.exe. For more information about wevtutil.exe, see wevtutil | Microsoft Learn
That’s it. Repeat the above steps to save the other logs if required.
One small request: If you liked this post, please share this?
One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!
