Exporting Windows Event Logs Through the Command Prompt: A Quick Guide

Windows event logs contain records of system and application events on a computer. In some cases, you may need to export these logs to a file for further analysis or troubleshooting. Here’s how you can do it through the Command Prompt:

Exporting event logs to a text file

To export an event log to a text file through the Command Prompt, you can use the wevtutil command. This command allows you to export an event log to a file in various formats, including text.

For example, to export the “Application” event log to a text file called “Application.txt,” you can use the following command:

wevtutil epl Application C:\Temp\Application.txt /f:text

This will export the “Application” event log to the “Application.txt” file in the “C:\Temp” directory in text format. You can specify a different log name and file path as needed.

Exporting event logs to an XML file

To export an event log to an XML file through the Command Prompt, you can use the wevtutil command with the /f:xml parameter.

For example, to export the “Security” event log to an XML file called “Security.xml,” you can use the following command:

wevtutil epl Security C:\Temp\Security.xml /f:xml

This will export the “Security” event log to the “Security.xml” file in the “C:\Temp” directory in XML format. You can specify a different log name and file path as needed.

Exporting all event logs to a single file

To export all event logs to a single file through the Command Prompt, you can use a combination of the wevtutil command and the FOR loop.

For example, to export all event logs to a single text file called “AllLogs.txt,” you can use the following commands:

wevtutil el > C:\Temp\AllLogs.txt
FOR /F "tokens=2 delims=:" %A IN ('wevtutil el') DO wevtutil epl %A C:\Temp\AllLogs.txt /f:text

This will export all event logs to the “AllLogs.txt” file in the “C:\Temp” directory in text format. You can specify a different file path as needed.

If you do not want to change the extension of the exported files, you can use the below commands

System Logs:

wevtutil epl System C:\SystemLog.evtx

Security Logs:

wevtutil epl Security C:\SecurityLog.evtx

Application Logs:

wevtutil epl Application C:\ApplicationLog.evtx

Whether you want to export a single log to a text, evtx or XML file, or all logs to a single file, these commands should help you achieve your goals.