2

Using WEVTUTIL.EXE to export the Windows Server 2008 Security event log, I get a permission problem (I have administrator privileges):

c:> wevtutil epl security test.evtx

"Failed to export log security. Access is denied."

I'm trying to write a script to backup and clear the Application, Security, Setup and System event logs. The Security log is the only one giving problems. How do I backup and clear it? I would like to know the "proper" way to do this, because I don't want to upset the security people (auditors, forensics, etc).

  • Setup a tool to forward all the events via the syslog protocol to a server that collates your logs? Adjust your log settings to only keep the last few days? - What kind of problem are you having that makes you think you actually need to purge this log? Manually clearing this log is almost never required. – Zoredache Apr 4 '14 at 23:51
  • @Zoredache We want to keep archives of those logs, stored on a network share drive. I'm not familiar with the first option you mentioned, I'll look into that. – zako42 Apr 5 '14 at 0:15
2

Either by using Group Policy or the local policy on the machine, go to

Computer Configuration -> 
  Administrative Templates -> 
    Windows Components -> 
      Event Log Service -> 
         [Application|Security|Setup|System]

And configure the setting "Back up log automatically when full."

This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled.

If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.

If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained.

If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained.

Then all your script needs to do is periodically harvest the directory for archived event log files and transfer them to your network share.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.