Windows Event Log

Windows ServiceMicrosoft Corporation

Also called eventlog, windows event log service

WindowsMicrosoft

The Windows service that writes and queries the event logs you open in Event Viewer.

What you need to know

This writes Event Viewer. Turning it off makes the next failure harder to explain.

EventLog is the service behind Application, System, and Security logs. It is not Windows Search and it is not a browser. Disable it only on a throwaway image.

Important?: Yes, for any later troubleshooting
High disk?: A noisy provider or a full log
Safe to disable?: No on a PC you still repair

Feex says

If a forum says disable Event Log to save disk, I would ignore that. The next boot failure is when you will want those rows.

What does this service do?

Display name: Windows Event Log. Service name: EventLog.

It accepts events from providers, writes EVTX files, and answers queries from Event Viewer and wevtutil. It does not host print jobs.

History on Windows

Still present

Windows has logged events since Windows NT. The modern Windows Event Log service and EVTX format shipped with Windows Vista. The service name EventLog is still the contract on Windows 10 and Windows 11. Windows XP used the older EVT format with a different viewer stack.

Windows Event Log service history
NT-era logging	Windows NT Event Log
Current EVTX service	Windows Vista (2007)
Still present	Yes, including Windows 10 and Windows 11
Discontinued	No

Why does Windows need it?

Servicing, security audits, and app crashes all write here. Without the service, those records never land.

When does it run?

It should run whenever Windows is up. Burst writes happen during an update or a failing driver.

Should it always be running?

Automatic is the default. Delayed start still leaves a gap at boot when you most want the log.

Can I disable it?

No on a PC you keep

Disabling EventLog stops new events. You will not have a System log for the next failure. Clear or resize a log instead of turning the service off.

What happens if I disable it?

Event Viewer cannot connect. Many Microsoft troubleshooters fail open. Security auditing stops.

Process host

EventLog commonly runs inside svchost.exe. See svchost.exe.

Dependencies

Windows Event Log dependencies
Depends on	RPC
Used by	Event Viewer, wevtutil, and most Windows components

Resource behavior

CPU: Low except during a flood of events
Disk: EVTX files under System32\winevt\Logs
Memory: Small
Network: Forwarded events if you configured them

Common problems

Log full

Change retention in Event Viewer. Do not disable the service to stop writes.

People delete winevt as cleanup

That breaks the channel. Use Event Viewer clear, not Explorer.

Troubleshooting

Safe steps first.

Open Event Viewer and sort by time

The service is working if new rows appear after a reboot.

wevtutil qe System /c:5

A command-line check when the MMC snap-in is blocked by policy.

Technical details

EventLog technical details
Display name	Windows Event Log
Service name	EventLog

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Event Log service · Event logging
Microsoft Learn: Event Viewer · Windows Event Log
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.