Example usage for wevtutil.
wevtutil qe System /c:10 /f:textwevtutil command
Query, export and manage Windows event logs.
Documented syntax
wevtutil [{el | enum-logs}] [{gl | get-log} <Logname> [/f:<Format>]]The linked Microsoft Learn article is the upstream authority. Availability may depend on Windows release, role, optional feature or interactive tool context.
Examples
Parameters, options and clauses
| Option / clause | Description |
|---|---|
el / enum-logs | List available event logs. |
qe / query-events <log> | Query events from a log. |
/q:<query> | Filter events with an XPath query. |
/c:<count> | Limit the number of returned events. |
/rd:true|false | Choose reverse direction for event enumeration. |
/f:text|xml | Choose the event output format. |
<Logname> | Microsoft documents this argument or subcommand; check the linked reference for its required format and context. |
/f:<Format> | Microsoft documents this switch; use the linked reference for accepted values, effects and version limits. |
Review a command and its target before running it. Commands that alter files, services, accounts, disks, permissions or databases may be difficult to reverse. Test in a safe environment and keep backups.