locked
Eventlog - how remove a custom source with PowerShell RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi all

    How can I remove a custom Eventlog source with PowerShell?

    I created a source with the statement

    New-Eventlog-LognameApplication-Source"MyCompany"

    Then I delete the source "successfully" with

    Remove-EventLog-Source"MyCompany"

    When I then check the sources, it is still listed as available

    Get-EventLog-LogNameApplication|Select-ObjectSource-Unique

    Can anybody tell me why this deleted source is still listed?

    Thanks for any answer,

    Juerg

    Thursday, October 6, 2016 9:04 AM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote
    The Remove-EventLog  deletes an event log or unregisters an event source.

    S.Sengupta, Windows Insider MVP

    • Marked as answer by clever4ever Monday, October 10, 2016 7:54 AM
    Saturday, October 8, 2016 11:54 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote
    The Remove-EventLog  deletes an event log or unregisters an event source.

    S.Sengupta, Windows Insider MVP

    • Marked as answer by clever4ever Monday, October 10, 2016 7:54 AM
    Saturday, October 8, 2016 11:54 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Thanks for your answer.

    I'm now going to check the availability of the Event source with the test-path cmdlet, like

    Test-PathHKLM:\System\CurrentControlSet\Services\EventLog\Application\MyCustomSource

    Monday, October 10, 2016 7:56 AM
  • Question
    Sign in to vote
    1
    Sign in to vote
    I found the answer to this question in another thread. 
    Posting it here for all you people from the future who are still using EventLog. 

    Run this command from Powershell with your custom log name between the quotes. 
    [System.Diagnostics.EventLog]::Delete("WrongNamedEventLog");

    • Edited by udstrat Tuesday, June 23, 2020 6:34 PM
    Tuesday, June 23, 2020 6:33 PM