>

Filter Event Logs from the CLI with wevtutil

Query the System or Application log for errors, newest first, without opening Event Viewer.

WindowscmdDiagnosticsevent-logLow risk
Run `wevtutil qe System /q:"*[System[(Level=2)]]" /c:20 /rd:true /f:text` to show the 20 most recent System log errors.

01Command

Command
$ wevtutil qe System /q:"*[System[(Level=2)]]" /c:20 /rd:true /f:text

02What it does

wevtutil qe queries event channels with an XPath filter; Level=2 means Error events, and /rd:true lists newest first. Change the channel name to Application or Security, or replace Level with (Level=1 or Level=2) to include Critical. The syntax is easy to forget because XPath filters are quoted and case-sensitive inside the brackets.

03Risk

RiskLow risk
RequirementsAdministrator privileges for some logs such as Security
!Warning: The /q filter string must be wrapped in quotes exactly as shown, or the XML brackets will be misparsed by the shell.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • wevtutil - Windows Commands
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents wevtutil, including the query-events (qe) command with /q XPath filter, /c count, /rd reverse direction and /f text format.

Last verified: 2026-09-17 · Category: System & Settings

06Related solutions

Get a Full System Summary with systeminfo
WindowshardwarecmdDiagnostics

One command that shows OS version, install date, boot time, memory, network adapters and installed hotfixes.

Low risk ✓ 2026-09-17
List All Installed Drivers with driverquery
WindowscmddriversDiagnostics

Built-in command that enumerates kernel drivers with state, start mode and file path.

Low risk ✓ 2026-09-17
Scan and repair Windows system files with SFC
WindowssystemTerminalDiagnostics

Use the System File Checker to verify every protected Windows system file against known-good copies and automatically replace the damaged ones.

Low risk ✓ 2026-09-17