How to fix Windows Event Log high CPU usage in Windows?

Service Host: Windows Event Log is the Windows service (EventLog) that writes and reads the event logs. High CPU almost always means something else is flooding it with events, or one log has grown huge. Find the repeating event first, then stop its source.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2, with the service details and wevtutil commands read from Microsoft Learn.

What Service Host: Windows Event Log is

Windows Event Log is a built-in Windows service. Its service name is EventLog, it is always installed and it starts automatically. Microsoft describes it like this: it manages events and event logs, and supports logging events, querying events, subscribing to events, archiving event logs and managing event metadata.

It runs inside a shared Service Host (svchost.exe) process, so Task Manager shows Service Host: Windows Event Log. Every time Windows, a driver or a program reports something, this service writes it to a log file. Every time Event Viewer or a tool reads the logs, this service answers too.

Why Service Host: Windows Event Log uses high CPU, from most to least common

Microsoft publishes no statistics for this, so the order comes from what the service does and the reports we read. Most often another component writes events in a loop. Less often a log has grown very large or is set to archive itself. Rarely the cause is damaged system files or malware.

How to fix Windows Event Log high CPU and disk usage

Fix 1 takes five minutes and tells you where to go. Fix 2 stops the source of the flood, which solves most cases. Fix 3 and Fix 4 shrink an overloaded log. Fix 5 to Fix 9 deal with a stuck service, third-party programs, updates, system files and malware.

Fix 1. Find the event that floods the log

5 minutesNo riskEveryone, before changing anything. It shows who keeps the service busy.

The Event Log service does not make work for itself. It writes what other components send it. A log that grows by hundreds of events a minute names its sender in the Source and Event ID columns, and that sender is what you fix.

1. Press Ctrl + Shift + Esc, select the CPU or Disk column and check that Service Host: Windows Event Log is on top.
2. Press Win + R, type eventvwr.msc and press Enter.
3. Expand Windows Logs and select Application, then System, then Security. The Number of events above the list shows how big each log is.
4. In each log, look at the Date and Time column. If the same Source and Event ID appear many times within the same minute, write them down.
5. Select one of those events and read the General tab. It usually names the service, program or file behind it.
6. Expand Applications and Services Logs too. A log there with a very high event count can be the source as well.

You can also read the newest events in a terminal. Open Terminal (Admin) from the Win + X menu. The first command shows the 20 newest System events, the second shows the size and record count of the log.

wevtutil qe System /c:20 /rd:true /f:text
wevtutil gli System

Fix 2. Repair the service or app that writes the repeating event

10 to 30 minutesLow riskFix 1 found an event ID that repeats many times a minute.

Clearing a log while its source still writes hundreds of events a minute only buys a few hours. In the Microsoft Q&A thread, the expert's answer was to fix WMI, because the event log was only doing what it knows how to do: reporting the issue.

1. Open the repeating event and note the program, service or file it names.
2. Update that program, or repair it in Settings > Apps > Installed apps (Windows 10: Apps > Apps & features) with Advanced options > Repair where offered.
3. If the program is one you no longer use, uninstall it as in Uninstall a program or app in Windows.
4. Restart the PC and open the same log again after ten minutes.

Fix 3. Save and clear the overloaded log

5 minutesRead the warningOne log holds hundreds of thousands of events, or Event Viewer takes a long time to open it.

The service has to index and search every event when a tool reads the log. A huge log makes every read heavy. Clearing it after a backup removes the weight without losing the history.

1. In Event Viewer, under Windows Logs, right-click the large log, for example Application, System or Security.
2. Select Clear Log....
3. Select Save and Clear, choose a folder such as Documents and give the file a name ending in .evtx.
4. Repeat for any other large log, then restart the PC.

The same in Terminal (Admin): the command below saves the Application log to a backup file and then clears it. Change the log name and the folder to yours.

wevtutil cl Application /bu:C:\Users\Public\Application-backup.evtx

Fix 4. Give the log a normal size and let it overwrite old events

5 minutesLow riskA log has a very large maximum size, or it is set to archive itself when full.

Microsoft's wevtutil reference explains the two modes: with retention off, new events overwrite the oldest ones; with auto backup on, the log is saved to a new file each time it is full. A log that archives itself again and again keeps the disk and the service busy.

1. In Event Viewer, right-click the log and select Properties.
2. Read Log size and Maximum log size (KB).
3. Under When maximum event log size is reached, select Overwrite events as needed (oldest events first).
4. Set Maximum log size (KB) to a moderate value, for example 20480 for 20 MB, and select OK.

To check the settings in Terminal (Admin), run the first line. The output shows retention, autoBackup and maxSize. The second line sets 20 MB and overwrite mode for the Application log.

wevtutil gl Application
wevtutil sl Application /ms:20971520 /rt:false /ab:false

Fix 5. Restart the Windows Event Log service

2 minutesLow riskThe load got stuck after a crash, an update or a big log export, and nothing repeats in the logs.

A service that got stuck on a large query or a damaged log can stay busy until it starts again. A restart releases it without changing any setting.

1. Open Services. Press Windows+R, type the command below and press Enter. You can also type Services in the search box on the taskbar and open the app.

   services.msc

2. Find the service. The list is sorted by Name. Click any row and type the first letter of the service to jump to it. Check the Status column (Running or empty) and the Startup Type column.
3. Restart the service. Right-click the service and select Restart. If the service is not running, select Start instead. Wait until the progress window closes.
4. Open its properties to change the startup type. Only if your guide says so: double-click the service. The General tab shows the Service name (used in commands), the Startup type and the Service status.
5. Set the startup type and apply. Choose the type from the Startup type list (Automatic, Automatic (Delayed Start), Manual or Disabled), select Apply, then Start if the service should run now, and OK.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Check and restart Windows services

In the list, the service is called Windows Event Log. Other services depend on it, so Windows may ask to restart them too: select Yes. If Restart is greyed out, restart the whole PC instead; it has the same effect.

Fix 6. Find the program behind the flood with a clean boot

20 minutesLow riskFix 1 shows many events but you cannot tell which program writes them, or security or monitoring software is installed.

Third-party security suites, monitoring agents, tune-up tools and hardware utilities can write or read thousands of events. A clean boot starts Windows with Microsoft services only. If the load is gone there, a third-party item causes it.

1. Open System Configuration. Select Search on the taskbar, type msconfig and select System Configuration from the results.
2. Hide Microsoft services. On the Services tab, select the Hide all Microsoft services check box. Only services from other companies stay in the list.
3. Disable the remaining services. Select Disable all, then select Apply.
4. Open Task Manager. On the Startup tab of System Configuration, select Open Task Manager.
5. Disable the startup apps. On the Startup apps tab in Task Manager, select each item whose status is Enabled and select Disable. Write down or take a screenshot of the items you disable: you need the list to turn them back on.
6. Confirm the changes. Close Task Manager. On the Startup tab of System Configuration, select OK.
7. Restart and test. Restart the PC. Windows now starts in a clean boot environment: try again the thing that failed (run the app, install the update, uninstall the program).

These steps were written for Windows 11 25H2 and 26H2. The full page with the other versions and what each result means: How to perform a clean boot in Windows

Fix 7. Install the latest Windows updates

15 to 40 minutesLow riskThe repeating events come from Windows components, or Windows Update shows failed or pending updates.

A Windows component that keeps failing writes an event each time. The fix for such a fault, if Microsoft has one, arrives through Windows Update.

1. Press Win + I and select Windows Update (Windows 10: Update & Security > Windows Update).
2. Select Check for updates and install everything offered.
3. Restart the PC when asked.
4. If an update fails again and again, reset the update components as in Reset Windows Update components.

Fix 8. Repair Windows system files with DISM and SFC

20 minutesNo riskThe load is high even in a clean boot, or the events point at missing or damaged Windows files.

The Event Log service and many of the services that write to it are Windows files. If those files or the component store are damaged, services fail and retry in a loop, and each try writes an event. DISM repairs the store and SFC replaces damaged files.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 9. Scan for malware with Microsoft Defender

15 to 60 minutesNo riskThe svchost.exe file is outside C:\Windows\System32, or the CPU stays high after every other fix.

Malware likes the svchost.exe name because many copies of it run on every PC, and some malware writes or wipes logs. A full Microsoft Defender scan rules it out.

1. In Task Manager, open the Services tab, right-click EventLog and select Go to details.
2. Right-click the highlighted svchost.exe and select Open file location. It should open C:\Windows\System32.
3. Run a full scan as described below.

1. Open Windows Security. Select Start, type Windows Security and open the app.
2. Open Virus & threat protection. Select Virus & threat protection. Under Current threats you see when the last scan ran, how long it took and how many files it checked.
3. Run a quick scan. Select Quick scan. If Windows Security thinks a deeper scan is needed, it tells you when the quick scan is done.
4. Open Scan options. If the quick scan finds nothing and you still suspect an infection, select Scan options under Current threats.
5. Run a full scan. Select Full scan and start it. It checks every file and program on the device, so it takes much longer than a quick scan. Leave the PC on until it ends.
6. Or scan one folder. To check only a download or a USB drive, select Custom scan in Scan options and choose the folder. You can also right-click a file or folder in File Explorer and select Scan with Microsoft Defender. On Windows 11 you may have to select Show more options first.
7. Read Protection history. Go back to the first page of Windows Security and select Protection history. Select a card to expand it and see the details.

These steps were written for Windows 11 25H2 and 26H2, Windows 10 22H2. The full page with the other versions and what each result means: How to scan for malware with Microsoft Defender

Windows Event Log still uses high CPU: what to check next

If the logs are small, nothing repeats and system files are fine, find out who is reading the logs rather than writing them. A tool that queries the logs all the time keeps the service busy too.

• Resource Monitor: type resmon in Start, open the Disk tab and look for processes that read files ending in .evtx. The process name shows who reads the logs.
• Reliability Monitor: type reliability in Start and open View reliability history. A red cross on the day the load began often names the update, driver or app behind it.
• Event forwarding and subscriptions: on a work PC, event forwarding and monitoring agents read logs all the time. Microsoft Q&A threads report high Event Log CPU after event forwarding was turned on. Ask your admin.
• Repair install: as a last step, reinstall Windows over itself and keep your files and apps: Reinstall Windows without losing files.

How to keep Windows Event Log from flaring up again

• Look at Event Viewer once a month. A single event ID that repeats thousands of times is a fault to fix early.
• Keep the logs on Overwrite events as needed with a moderate maximum size, unless your organization needs another setting.
• Do not install optimizers, registry cleaners or log cleaners. Windows does not need them, and some of them read or clear logs all the time.
• Keep Windows Update on and let updates finish before you shut down.
• Never disable the Windows Event Log service to save resources. Microsoft says stopping it may compromise system security and reliability.

Frequently asked questions

What is Service Host: Windows Event Log?

It is the svchost.exe process that runs the Windows Event Log service, service name EventLog. Microsoft describes the service as the one that manages events and event logs: it logs events, answers queries, handles subscriptions and archives logs. It is always installed and starts automatically. Every message you see in Event Viewer was written by this service, so it is busy whenever Windows or a program reports a lot.

Can I disable the Windows Event Log service?

No. Microsoft warns that stopping this service may compromise system security and reliability. Event Viewer stops working, security auditing stops and other services that depend on it fail to start. The load you see is a symptom: something writes or reads too many events. Find that source as in Fix 1 and Fix 2. If you only want to reset it, restart the service or the PC as in Fix 5.

Why does Service Host: Windows Event Log use high disk?

Every event is a write to a log file, so a flood of events shows up as disk activity before it shows up as CPU. In a Microsoft Q&A thread, a user saw 100 % disk from this process while the Application log was almost full of event 1001 and the System log of events 7031 and 7024. The fix is the same as for CPU: find the repeating event (Fix 1), stop its source (Fix 2) and give the log a normal size (Fix 4). On a slow hard drive the effect is much stronger.

Is there an event ID for high CPU utilization?

We found no standard Windows event that is written whenever the CPU is high, so searching Event Viewer for one will not help. Windows records crashes, failed services and errors, not CPU load. To see what uses the CPU over time, use Task Manager, Resource Monitor or Performance Monitor (perfmon). The events that matter on this page are the ones that repeat many times a minute, because each of them costs the Event Log service work.

Why does Windows Error Reporting Service or Windows Problem Reporting use high CPU?

Windows Error Reporting Service (WerSvc) is a different service. Microsoft says it lets the system report errors when programs stop working or responding. Its startup type is Manual, so it runs only when there is something to report. Constant load means a program crashes or hangs again and again. Find it in Reliability Monitor or in event 1001 in the Application log, then repair it; our guide on Event ID 1001 explains the report. Microsoft recommends not disabling WerSvc.

What if Host Process for Windows Services uses high CPU?

Host Process for Windows Services is the description of svchost.exe, the process that runs most Windows services, including Windows Event Log. Expand the line in Task Manager to see which service is inside. If it is Windows Event Log, use this page. If it is another service, search for that name. For example, our guide on Service Host DCOM high CPU covers DCOM Server Process Launcher.

Is it safe to clear the event logs?

Yes, for a home PC, as long as you save them first. Clearing removes the history of past events, not any setting or file Windows needs. Use Save and Clear in Event Viewer or wevtutil cl with the /bu option, as in Fix 3. Windows starts a new log at once. On a work or school PC, ask your admin before you clear the Security log, because it can be needed for audits.

Is Service Host: Windows Event Log a virus?

The real service is part of Windows and runs from C:\Windows\System32\svchost.exe. Malware can use the same file name in another folder. Check it as in the first steps of Fix 9: if Open file location opens System32, it is the Windows file. If it opens anywhere else, or the load stays after every fix, run a full Microsoft Defender scan.

What about WinGet COM Server hogging CPU?

This page is about the Windows Event Log service, not WinGet COM Server. That process belongs to the Windows Package Manager (winget). The same method finds the cause. Check what runs with it in Task Manager and look for repeating events in the Application log. Then install Windows and Microsoft Store updates, and use a clean boot as in Fix 6 if a third-party tool keeps calling it.

Does this guide apply to other languages of Windows?

Yes. Task Manager and Event Viewer are translated, so the names differ. For example, Event Viewer logs are called журнал событий Windows in Russian. The service name EventLog and the wevtutil commands stay the same in every language. The fixes on this page work in any language of Windows 11 and Windows 10.