Event log retention

by Mitch Tulloch [Published on 26 May 2006 / Last Updated on 26 May 2006]

How to configure event log retention in Windows Vista.

Windows Vista now lets you configure event logging settings more than ever before using Group Policy. One of the new settings you can configure is event log retention. By default, when an event log such as the Application log becomes full, oldest events are overwritten by newer ones. You can prevent this from happening by configuring local Group Policy as follows:

1. Type gpedit.msc in the Start Search box and hit Enter.

2. Click Continue when the UAC prompt appears.

3. Navigate to the following policy location:

Computer Configuration\Administrative Templates\Windows Components\Event Log Service

4. Look under Application, Security, Setup or System to configure settings for the log desired.

5. Enable the following policy setting:

Retain old events

If you enable this setting, any new events written to a log that is full are discarded instead of overwriting old events. As a result, if you want to consider using this setting you should also back up your event logs when they become full--this is covered in my next tip.

Mitch Tulloch, MVP

The Author — Mitch Tulloch

Mitch Tulloch is a widely recognized expert on Windows administration, networking, and security. He has been repeatedly awarded Most Valuable Professional (MVP) status by Microsoft for his outstanding contributions in supporting users who deploy and use Microsoft platforms, products and solutions. Mitch has published over two hundred articles on different IT websites and magazines, and he has written or contributed to almost two dozen books and is lead author for the Windows 7 Resource Kit from Microsoft Press. For more information, see www.mtit.com .

Latest Contributions

Featured Links