EVENT VIEWER LOG ARCHIVE

In this article I will talk about the steps to archive Event Viewer Windows logs on our server.

The Application, Security, Setup, System, and Forwarded Events layers under Windows logs in Event Viewer allow us to access server logs about the relevant layers. However, when the log records reach certain sizes, the oldest log record is deleted and a new log record is recorded in its place. This proceeds as a queue logic, meaning first in, first out. Under Windows logs, we can understand this queue logic as the first written is the first deleted.

Image — 1

If you’re wondering how to check at what size the Windows logs in the server are deleted and new records are written in their place, let’s move on to the steps right away;

Right-click on the relevant Log > Properties > Maximum log size

This area shows the maximum size that your log file will reach. When the maximum size is reached, the oldest log record is deleted and a new log record is recorded in its place, proceeding as queue logic, first in first out. You can increase or decrease this size according to the configuration settings of your own environments.

Image — 2

Let’s say that the size of our logs is not enough for us and we want to archive them because we don’t want to lose our historical logs, now let’s talk about how we can archive our logs.

Right-click on the relevant Log > Properties > Archive the log when full, do not overwrite events

As seen in the image below, first of all, we have to specify the path to write archive logs, when we check the ‘Archive the log when full, do not overwrite events’ option, archiving will automatically take place when the specified log size is reached.

Image — 3

This concludes the steps to archive Windows logs in Event Viewer, until next time, until we see you in the next article, sincere regards 😊