What is the default retention and archiving mechanism for Windows 2012 Event Logs?

Question

How does Windows 2012 manage event logs retention? Does it 'rotate' logs like *NIX systems?
Does it automatically delete old logs when disk is full.
Any way to define log retention period? (e.g. delete logs older than six months)

Have you looked at the properties for any of the logs? – joeqwerty Dec 22 '15 at 13:20 — joeqwerty, Dec 22 '15 at 13:20

score 4 · Accepted Answer · answered Dec 22 '15 at 13:59

4

Looks like Windows rotates it, and yes, there is a way to configure the retention policy. And here is a pretty good article on Managing of event logs:

https://technet.microsoft.com/en-us/library/cc766178.aspx

Hope that gonna help

answered Dec 22 '15 at 13:59

Anatoly Vilchinsky

361
1
7

What do you mean by "rotates"? – Mathias Lykkegaard Lorenzen Jan 10 '17 at 12:56
I mean that it removes the old ones – Anatoly Vilchinsky Jan 16 '17 at 10:23

What is the default retention and archiving mechanism for Windows 2012 Event Logs?

1 Answers1