10

Windows Server 2003.

Is there any way to easily rotate event logs (or automatically clear and save)? I'm doing a bit of auditing on this machine and my security log gets real big real quick and every couple of weeks I have to remember to save and clear it out.

Yeah I could rely on backup jobs and enable overwriting...but it would be nicer if I could just get Windows to automatically save and clear the log when it's nearing capacity.

Boden
  • 4,968
  • 12
  • 49
  • 70

3 Answers3

13

It seems like most people don't know about this feature, but Windows will rotate the log files automatically if so-configured. Look for "AutoBackupLogFiles" in this file.

You can configure this on a server-for-server basis, but that's tedious for a large number of servers. I created an Administrative Template to set this on server computers, and then scripted a startup script to add a scheduled task to periodically pick up, ZIP, and move the log files to a retention location. It worked really well, and was cheap!

http://mx02.wellbury.com/misc/EventLogPolicy.adm

Evan Anderson
  • 141,881
  • 20
  • 196
  • 331
  • +1 Nice tip. I am going to give it a try. – kentchen Jun 16 '09 at 22:20
  • Will this only work on 2008/Vista or will it work on 2000/XP/2003 as well? What should the retention policy be set to? – msvcyc Jun 26 '09 at 18:51
  • 1
    I've never tried this on Server 2008 or Vista. It works fine on Server 2003 and 2000, and Microsoft says it works on Windows XP. The retention setting needs to be 0xffffffff for it to work on 2003/XP/2000. You can see some more details from Microsoft at: http://msdn.microsoft.com/en-us/library/aa363648(VS.85).aspx – Evan Anderson Jun 27 '09 at 07:19
  • 1
    I wish there were instructinos on how to configure it oneself instead of downloading an ADM file – Jonathan Feb 02 '15 at 18:55
2

Here's a VBS script that will save your event log and clear it. Put this in a scheduled task. Note that the specific event log is specified in line 3 of the script and that you'll obviously want to tweak the target path.

Code "borrowed" (ie- stolen) from MSDN.

strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate,(Backup)}!\\" & strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery("Select * from Win32_NTEventLogFile Where LogFileName='Application'")
For Each objLogfile in colLogFiles
    errBackupLog = objLogFile.BackupEventLog("c:\\application" & year(Now) & "_" & month(Now) & "_" & day(Now) & "_" & hour(now) & "_" & minute(now) & ".evt")
    objLogFile.ClearEventLog
Next
squillman
  • 37,883
  • 12
  • 92
  • 146
0

To see the configurable options for a custom ADM template, you probably need to click the View menu, and uncheck "only show policy settings that can be fully managed".