除了最近24小时之外，是否有任何方法可以从Windows事件日志（应用程序，系统和软件）中删除所有条目？
通过batch file等命令行。
在Windows 2008 R2服务器和Windows 7上
你不能做你想做的事情。 您可以保存或清除事件日志。 清除时，可以select在清除之前保存事件。
编辑
再次看，这不是很有帮助。 您不能从事件日志中删除一些事件而不删除所有事件。 但是，您可以根据筛选器导出一些事件。 例如，以下命令将导出在过去24小时内logging到系统事件日志的所有事件：
wevtutil epl system c:\system.evtx /q:"*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]"
这是否接近你想要的？ 如果没有，你能否澄清是否还有更多我们可以提供帮助的东西？
find这个：
If WScript.Arguments.Count > 1 Then WScript.Echo WScript.Echo "Usage: cscript ""Clear Event Logs.vbs"" [computer name]" WScript.Echo WScript.Quit End If Dim strComputer ' As String If WScript.Arguments.Count > 0 Then strComputer= WScript.Arguments(0) Else strComputer= "localhost" End If ClearEventLogs strComputer WScript.Echo "Done" Private Sub ClearEventLogs( _ strComputer) WScript.Echo "Clearing event logs on " & strComputer & "..." Set objWMIService = GetObject( _ "winmgmts:" & "{impersonationLevel=impersonate,(Backup)}!\\" _ & strComputer & "\root\cimv2") Set colLogFiles = objWMIService.ExecQuery( _ "Select * from Win32_NTEventLogFile") For Each objLogfile in colLogFiles ClearEventLog strComputer, objLogfile.LogfileName Next End Sub Private Sub ClearEventLog( _ strComputer, _ strEventLogName) WScript.Echo "Clearing '" & strEventLogName & "' event log on " _ & strComputer & "..." Set objWMIService = GetObject( _ "winmgmts:" & "{impersonationLevel=impersonate,(Backup)}!\\" _ & strComputer & "\root\cimv2") Set colLogFiles = objWMIService.ExecQuery( _ "Select * from Win32_NTEventLogFile where LogFileName='" _ & strEventLogName & "'") For Each objLogfile in colLogFiles Dim backupFilename backupFilename= "C:\" & strEventLogName & "_" & GetFormattedTimestamp() _ & ".evt" errBackupLog = objLogFile.BackupEventLog(backupFilename) If errBackupLog <> 0 Then WScript.Echo "The " & strEventLogName & " event log on " _ & strComputer & " could not be backed up." Else objLogFile.ClearEventLog() End If Next End Sub Private Function GetFormattedTimestamp() Dim timestamp timestamp = Now GetFormattedTimestamp = Year(timestamp) _ & LPad(Month(timestamp), 2, "0") _ & LPad(Day(timestamp), 2, "0") _ & "_" & Replace(FormatDateTime(timestamp, 4), ":", "") End Function Private Function LPad( _ strValue, _ nLength, _ strPadCharacter) Dim strPaddedValue strPaddedValue = strValue While (Len(strPaddedValue) < nLength) strPaddedValue = strPadCharacter & strPaddedValue WEnd LPad = strPaddedValue End Function
这里： http : //blogs.msdn.com/b/jjameson/archive/2011/03/01/script-to-clear-and-save-event-logs.aspx
从博客的另一个注意事项：运行它使用cscript，而不是wscript。