Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok a basic question i hope...


There is currently a plan to implement auditing on one of the networks i am managing they would like to set the event viewer to retain events for 31 day's


What would be the suggested site of the log files? also what would happen if the event log was full but none of the files were over 31 day's old...

Hopefully a simple question haven't come across this before tho :)

share|improve this question
up vote 1 down vote accepted

31 days doesn't seem unreasonable, but it entirely depends on what's being logged and what the potential usage of the logs would be. The size of the event log depends entirely on how many events have been recorded. You can fix the event log retention at 31 days but you will need to consider:

  • Even if you 'benchmark' your event log size and know that it will normally be an acceptable size with 31-days retention, what about unusual circumstances that cause it to grow in size? Chances are those are also the times at which you want to go and look at the event log.
  • You open yourself up to an exploit if you set event log retention to a fixed period of time: An attacker just has to identify any method of making an entry in your event log, then repeat that action a whole lot of times and consume all the free space on your server. An unlikely scenario, but highlights the point that 'interesting' stuff can start happening when you pick a particular log retention policy*

You may wish to configure Event Log Forwarding to a central server with lots of spare disk space.

*Even more interesting things happen if you pick 'Rotate after x events'. In that case, an attacker can do whatever they like to the server then just spam the event log to flush records of their actions and clear their tracks.

share|improve this answer

To be honest, Event viewer is one of the weakest of Microsofts products. Install a third party event log handler. I use Splunk on my own machines (which is a free download if you are logging small amounts of data, but costs as you grow). It reads not only event logs, but things like WMI, Perfmon and SQL Server logs.

share|improve this answer
Thats the route that i am most likely going towards at the moment but am still looking in to the complications for my company ^.^ – Trozz May 3 '11 at 11:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.