Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows Server 2003.

Is there any way to easily rotate event logs (or automatically clear and save)? I'm doing a bit of auditing on this machine and my security log gets real big real quick and every couple of weeks I have to remember to save and clear it out.

Yeah I could rely on backup jobs and enable overwriting...but it would be nicer if I could just get Windows to automatically save and clear the log when it's nearing capacity.

share|improve this question
up vote 11 down vote accepted

It seems like most people don't know about this feature, but Windows will rotate the log files automatically if so-configured. Look for "AutoBackupLogFiles" in this file.

You can configure this on a server-for-server basis, but that's tedious for a large number of servers. I created an Administrative Template to set this on server computers, and then scripted a startup script to add a scheduled task to periodically pick up, ZIP, and move the log files to a retention location. It worked really well, and was cheap!

share|improve this answer
+1 Nice tip. I am going to give it a try. – kentchen Jun 16 '09 at 22:20
Will this only work on 2008/Vista or will it work on 2000/XP/2003 as well? What should the retention policy be set to? – msvcyc Jun 26 '09 at 18:51
I've never tried this on Server 2008 or Vista. It works fine on Server 2003 and 2000, and Microsoft says it works on Windows XP. The retention setting needs to be 0xffffffff for it to work on 2003/XP/2000. You can see some more details from Microsoft at: – Evan Anderson Jun 27 '09 at 7:19
I wish there were instructinos on how to configure it oneself instead of downloading an ADM file – Jonathan Leaders Feb 2 '15 at 18:55

Here's a VBS script that will save your event log and clear it. Put this in a scheduled task. Note that the specific event log is specified in line 3 of the script and that you'll obviously want to tweak the target path.

Code "borrowed" (ie- stolen) from MSDN.

strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate,(Backup)}!\\" & strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery("Select * from Win32_NTEventLogFile Where LogFileName='Application'")
For Each objLogfile in colLogFiles
    errBackupLog = objLogFile.BackupEventLog("c:\\application" & year(Now) & "_" & month(Now) & "_" & day(Now) & "_" & hour(now) & "_" & minute(now) & ".evt")
share|improve this answer

To see the configurable options for a custom ADM template, you probably need to click the View menu, and uncheck "only show policy settings that can be fully managed".

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.