8.3.3 Managing Audit Logs
You can track trends in Windows Server 2003 by archiving event logs and comparing logs from different
periods. Viewing trends can be used to determine resource use and to plan for growth. Windows Server
2003 also allows you to control the size of each audit log and to specify the action that Windows Server
2003 takes when the log becomes full. These can be configured in the
of each individual audit
log. To configure the settings for logs:
• Click on the
button to display the Start Menu
• Point to
• Click on
• Click on
• Right-click the Log you want to configure
from the pop-up menu
• Set the
MAXIMUM LOG SIZE
• Set the Action that should be taken when the log file become full
The default the maximum log size is 512 KB but you can set it to be from 64 KB to 4,194,240 KB (4 GB) in
The action that you can specify for when a log file becomes full are:
• Overwrite Events As Needed. This setting requires no maintenance but you could lose information if
the log becomes full before you archive it.
• Overwrite Events Older Than [number] Days. This is the default setting. You must select the number
of days for this option; the default is seven. You could lose information if the log becomes full before
you archive it.
• Do Not Overwrite Events (Clear Log Manually). With this option no security log entries will be
overwritten therefore there will be no information loss. It however requires that you to clear the log
manually. When the log becomes full, Windows Server 2003 will stop.
Note: When the log file becomes full and you have specify the Do Not
Overwrite Events (Clear Log Manually) action, Windows Server 2003
stops. You can therefore use this configuration to ensure that Windows 2000
only operates while auditing occurs.