Event log retention

How to configure event log retention in Windows Vista.

Windows Vista now lets you configure event logging settings more than ever before using Group Policy. One of the new settings you can configure is event log retention. By default, when an event log such as the Application log becomes full, oldest events are overwritten by newer ones. You can prevent this from happening by configuring local Group Policy as follows:

1. Type gpedit.msc in the Start Search box and hit Enter.

2. Click Continue when the UAC prompt appears.

3. Navigate to the following policy location:

Computer ConfigurationAdministrative TemplatesWindows ComponentsEvent Log Service

4. Look under Application, Security, Setup or System to configure settings for the log desired.

5. Enable the following policy setting:

Retain old events

If you enable this setting, any new events written to a log that is full are discarded instead of overwriting old events. As a result, if you want to consider using this setting you should also back up your event logs when they become full–this is covered in my next tip.

Article written by MyComputerAid.com