# Windows Event Log

Windows Service: Microsoft Corporation

Also called eventlog, windows event log service

Windows, Microsoft

The Windows service that writes and queries the event logs you open in Event Viewer.

## What you need to know

This writes Event Viewer. Turning it off makes the next failure harder to explain.

EventLog is the service behind Application, System, and Security logs. It is not Windows Search and it is not a browser. Disable it only on a throwaway image.

- **Important?**: Yes, for any later troubleshooting

  **High disk?**: A noisy provider or a full log

  **Safe to disable?**: No on a PC you still repair

Feex says

If a forum says disable Event Log to save disk, I would ignore that. The next boot failure is when you will want those rows.

## What does this service do?

Display name: Windows Event Log. Service name: EventLog.

It accepts events from providers, writes EVTX files, and answers queries from Event Viewer and wevtutil. It does not host print jobs.

## History on Windows

Still present

Windows has logged events since Windows NT. The modern Windows Event Log service and EVTX format shipped with Windows Vista. The service name EventLog is still the contract on Windows 10 and Windows 11. Windows XP used the older EVT format with a different viewer stack.

| NT-era logging       | Windows NT Event Log                     |
| -------------------- | ---------------------------------------- |
| Current EVTX service | Windows Vista (2007)                     |
| Still present        | Yes, including Windows 10 and Windows 11 |
| Discontinued         | No                                       |

## Why does Windows need it?

Servicing, security audits, and app crashes all write here. Without the service, those records never land.

## When does it run?

It should run whenever Windows is up. Burst writes happen during an update or a failing driver.

## Should it always be running?

Automatic is the default. Delayed start still leaves a gap at boot when you most want the log.

## Can I disable it?

No on a PC you keep

Disabling EventLog stops new events. You will not have a System log for the next failure. Clear or resize a log instead of turning the service off.

## What happens if I disable it?

Event Viewer cannot connect. Many Microsoft troubleshooters fail open. Security auditing stops.

## Process host

EventLog commonly runs inside svchost.exe. See svchost.exe.

## Dependencies

| Depends on | RPC                                                 |
| ---------- | --------------------------------------------------- |
| Used by    | Event Viewer, wevtutil, and most Windows components |

## Resource behavior

- **CPU**: Low except during a flood of events

  **Disk**: EVTX files under System32\winevt\Logs

  **Memory**: Small

  **Network**: Forwarded events if you configured them

## Common problems

### Log full

Change retention in Event Viewer. Do not disable the service to stop writes.

### People delete winevt as cleanup

That breaks the channel. Use Event Viewer clear, not Explorer.

## Troubleshooting

Safe steps first.

### Open Event Viewer and sort by time

The service is working if new rows appear after a reboot.

### wevtutil qe System /c:5

A command-line check when the MMC snap-in is blocked by policy.

## Technical details

Technical details

| Display name | Windows Event Log |
| ------------ | ----------------- |
| Service name | EventLog          |

## Related

These entities connect to this article. Type is shown on every link.

[svchost.exe: Windows Process](https://feex.it/wiki/process/svchost.exe)[Process vs service: Guide](https://feex.it/wiki/software/system/process-vs-service)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Event Log service ](https://learn.microsoft.com/windows/win32/eventlog/event-logging)· Event logging
- [Microsoft Learn: Event Viewer ](https://learn.microsoft.com/windows/win32/wes/windows-event-log)· Windows Event Log
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Display name**: Windows Event Log

  **Service name**: EventLog

  **Host process**: [svchost.exe](https://feex.it/wiki/process/svchost.exe)

  **Safe to disable?**: You lose diagnostics

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/service/windows-event-log/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)