Why does Application event log get cleared when I remove this custom even log

Krzysztof Jabłoński

6/16/24, 1:44 AM

I am using powershell cmdlets to create a new event-log, register a source and log events. I experience some unexpected behavior. I created a new log with an arbitrary name by issuing the command:

New-EventLog -LogName SchedulerWakeUpTask -Source devops

I have verified in Event Viewer that it has appeared in "Applications and services logs" directory. I then created an event with

Write-EventLog -LogName SchedulerWakeUpTask -Source devops -EventId 1000 -Message "All good."

but the event didn't get logged in the correct log, but in the Application log instead. It resembles the behavior described in this question. In log properties I have verified that my custom log has been assigned a specific separate log file with path %SystemRoot%\System32\Winevt\Logs\SchedulerWakeUpTask.evtx. Having checked that, I then removed the log by issuing command

Remove-EventLog -LogName SchedulerWakeUpTask

After that, the empty log has disappeared from the event viewer, but also the whole Application log has been wiped out clean. Why?

Seeing the havoc already present I decided to test this a little more. The test concludes that:

source name doesn't matter
application event log consistently gets cleared every time I create and remove custom log with this particular name again
application event log does not get cleared when I attempt to remove this custom log if it doesn't exist
application event log does not get cleared when I create another custom event log with an arbitrary name of SchedulerWakeUpTask2, or SchedulerWakeUpTas, or SchedulerWakes, or kapusta, or whatever;
application event log does not get cleared when I remove only the source associated with the custom log
when custom log is created again and an event is emitted with Write-EventLog it's again only visible in Application event log
it's not a visual glitch with Event Viewer, Get-EventLog -LogName Application says No match and the assigned event file has been truncated (used to be over 100MB IIRC, but it's size is a negligent 70kB now)

0 + 2

powershell

windows-event-log

Vadim

6/16/24, 2:31 PM

Try to restart Windows Event Log Service after creating a custom log.

Krzysztof Jabłoński

6/16/24, 8:07 PM

@Vadim thanks for the suggestion. I believe it may resolve this instance of the problem, but surely it will not fix the root cause.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Why does Application event log get cleared when I remove this custom even log

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.