• Windows
  • Logs

Event logs: 66 MB on a healthy machine, gigabytes on a sick one

Windows caps each log channel, so a large logs folder is a symptom rather than a cleanup job. How to read the sizes and find the cause.

5 min read

Logs are the one part of a full drive worth reading before deleting. Windows caps its main event channels, so a logs folder that has become large is usually recording the same failure thousands of times, and clearing it removes the evidence without fixing anything.

The two places logs actually live

PathWhat it holdsBounded
C:\Windows\System32\winevt\LogsThe event channels, as .evtx filesYes, per channel maximum
C:\Windows\LogsServicing, CBS, DISM and setup logsMostly, and CBS is the exception
C:\Windows\Logs\CBSComponent servicing, written on every updateGrows on a machine that fails updates repeatedly
C:\Windows\PantherSetup and upgrade logsLeft behind by an upgrade

Listing every channel by size

# Which channels are largest, and what each is allowed to reach
Get-WinEvent -ListLog * -EA SilentlyContinue |
  Where-Object RecordCount -gt 0 |
  Select-Object LogName,
    @{n='MB';e={[math]::Round($_.FileSize/1MB,1)}},
    @{n='MaxMB';e={[math]::Round($_.MaximumSizeInBytes/1MB,1)}},
    RecordCount |
  Sort-Object MB -Descending | Select-Object -First 15

The MaxMB column is the answer to most of the worry. A channel at its maximum is behaving correctly and will overwrite its own oldest entries. A channel far above what you expected is the one to open.

Reading before clearing

# The most common errors in the last week, most frequent first
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddDays(-7)} -EA SilentlyContinue |
  Group-Object Id, ProviderName |
  Sort-Object Count -Descending | Select-Object -First 10 Count, Name

If one identifier accounts for thousands of entries, that is the thing filling the folder. A failing disk, a service restarting in a loop and a driver that faults on every wake all look exactly like this.

Clearing a channel, once you know why

# Elevated. Clears one channel, keeping its settings.
wevtutil cl Application

# Raise a cap rather than clearing repeatedly
wevtutil sl Application /ms:67108864

C:\Windows\Logs\CBS is the folder that genuinely grows without limit, and it grows when updates fail over and over. The fix is the update, which is covered in when an update says there is not enough space, not the log.

Crash records are a separate story with a separate folder, covered in crash dumps and Windows Error Reporting. Those genuinely can be gigabytes, and they are also evidence.

Common questions

How much space do Windows event logs use?

Usually very little, because each channel has a maximum size and overwrites its oldest entries. C:\Windows\Logs measured 66 MB on a healthy machine in September 2026.

Is it safe to delete .evtx files?

You can clear a channel with wevtutil cl, but the files are the record of what the machine has been doing. If a log has grown unusually large, read it before clearing it, since the size itself is the symptom.

Why is my CBS log folder so large?

Because component servicing writes to it on every update attempt, and a machine that fails the same update repeatedly writes the same failure each time. Fixing the update stops the growth.

How do I see which event log is largest?

Get-WinEvent -ListLog * shows FileSize and MaximumSizeInBytes for every channel. Sorting by size shows both what is large and whether it is already at its intended cap.

Read next