{"id":555,"date":"2018-09-04T08:00:55","date_gmt":"2018-09-04T14:00:55","guid":{"rendered":"https:\/\/practicalpowershell.com\/?p=555"},"modified":"2020-03-14T14:20:46","modified_gmt":"2020-03-14T20:20:46","slug":"event-log-configuration","status":"publish","type":"post","link":"https:\/\/practicalpowershell.com\/event-log-configuration\/","title":{"rendered":"Event Log Configuration"},"content":{"rendered":"

Production servers require a lot of attention and configuration before they are ready to be put into service. For this article we’ll work on an oft overlooked configuration item for new servers – Event Logs. Why event Logs? Event Logs are one of the first places a server admin looks in order to troubleshoot a server issue or confirm a particular action has occurred.
\nCore Event Logs on a Windows server are Application, Security and System. These three are typically also the first place to begin troubleshooting a particular issue with a server:
\n\"\"<\/a>
\nHow can we manipulate and query these log files with PowerShell?

\nPowerShell<\/em>

\nWhat PowerShell cmdlets exist for manipulating Event Logs? These cmdlets can be found with the Get-Command:
\n[sourcecode language=”powershell”]
\nGet-Command *eventLog*
\n[\/sourcecode]
\nThis reveals nine PowerShell cmdlets:
\n[sourcecode language=”powershell”]
\nGet-EventLogLevel
\nSet-EventLogLevel
\nClear-EventLog
\nGet-EventLog
\nLimit-EventLog
\nNew-EventLog
\nRemove-EventLog
\nShow-EventLog
\nWrite-EventLog
\n[\/sourcecode]
\nWhen I first saw these cmdlets, the one cmdlet that stuck out was the ‘limit-eventlog’ cmdlet. Limit is not a typical verb used in Microsoft PowerShell. If we were creating a standardized naming convention I would think these verbs would do – Get, New, Remove, Set. Others listed make sense for their particular function – Clear-EventLog and Write-EventLog. However I need to resize the logs, which cmldet do I choose since there is not Set-EventLog? Limit-EventLog is the cmdlet we need to make these changes.
\nFirst we can review the PowerShell help for the cmdlet, like so:
\n[sourcecode language=”powershell”]
\nGet-Help Limit-EventLog -Full
\n[\/sourcecode]
\nParameters for Limit-EventLog:
\n[sourcecode language=”powershell”]
\nLogName
\nComputerName
\nRetentionDays
\nOverflowAction – OverwriteOlder | OverwriteAsNeeded | DoNotOverwrite
\nMaximumSize
\n[\/sourcecode]
\nFor an example environment I want to configure the mail Windows Event Logs to 100MB and to over write as the log needs too to keep the size at 100MB. We can simply use three of the above parameters to do this:

\nLogName<\/em> – This switch lets you specify which log file to use. It is required.
\nOverflowAction <\/em>– specified how to handle this in the case where the events in the log exceed a certain size (MaixumumSize) or a certain number of days (RetentionDays).
\nMaximumSize<\/em> – choose the maximum size of the event log you specified with – LogName. Caveat here, must be divisible by 32 Bytes. So 100MB, would be 100032kb.

\nFor a sample setup, the IT manager would like to set each server’s three core Event Logs to 100MB in size and that the Event Logs should be rolling logs where newer events overwrite older events. In terms of a single server, we can plug in the log name, maximum size and over flow action into three different cmdlets:
\n[sourcecode language=”powershell”]
\nLimit-EventLog -LogName Application -MaximumSize 100032Kb -OverflowAction OverwriteAsNeeded
\nLimit-EventLog -LogName System -MaximumSize 100032Kb -OverflowAction OverwriteAsNeeded
\nLimit-EventLog -LogName Security -MaximumSize 100032Kb -OverflowAction OverwriteAsNeeded
\n[\/sourcecode]
\nNow if we wanted to apply this to a group of servers, we can use a CSV files and a Foreach loop to apply these settings en masse:
\n[sourcecode language=”powershell”]
\n$CSV = Import-CSV 'Servers.Csv'
\nForeach ($Line in $CSV) {
\n$Server = $Line.Server
\nLimit-EventLog -ComputerName $Server -LogName Application -MaximumSize 100032Kb -OverflowAction OverwriteAsNeeded
\nLimit-EventLog -ComputerName $Server -LogName System -MaximumSize 100032Kb -OverflowAction OverwriteAsNeeded
\nLimit-EventLog -ComputerName $Server -LogName Security -MaximumSize 100032Kb -OverflowAction OverwriteAsNeeded
\n}
\n[\/sourcecode]
\nWhile 100 MB is a good size for event logs, the absolute limit is 4GB for each and up to 16GB for a modern Windows OS (in 2018). For your own environment there could be other factors at play in terms of how a server’s Event Logs should be sized:<\/p>\n