Something is deleting the event viewer data on the server but we cant find it

Question

There is a task we thinking running on the server that deletes the event viewer log each time the server reboots (makes it impossile to debug sever crashes). It also seemingly deletes the data automtically every few hours.

We've spent hours trying to find what is causing this or what task is doing this. So far we're getting really frustrated by it as we cant find it!

How can we find what is causing this deletion of critical information?

Answer 1

Hello there,

Do you have audit software on the device?

Open the Event Viewer and search the security log for event ID 4656 with a task category of "File System" or "Removable Storage" and the string "Accesses: DELETE".

Review the report. The "Subject: Security ID" field will show who deleted each file.

For your situation, I would recommend using the Procmon tool to identify the process of deleting the Event Viewer logs.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. You can get the tool from here https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log.You can get the tool from here https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–