Something is deleting the event viewer data on the server but we cant find it

Richard Wyatt 0 Reputation points
2023-05-19T13:51:08.8166667+00:00

There is a task we thinking running on the server that deletes the event viewer log each time the server reboots (makes it impossile to debug sever crashes). It also seemingly deletes the data automtically every few hours.

We've spent hours trying to find what is causing this or what task is doing this. So far we're getting really frustrated by it as we cant find it!

How can we find what is causing this deletion of critical information?

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,607 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 44,116 Reputation points
    2023-05-22T12:10:00.89+00:00

    Hello there,

    Do you have audit software on the device?

    Open the Event Viewer and search the security log for event ID 4656 with a task category of "File System" or "Removable Storage" and the string "Accesses: DELETE".

    Review the report. The "Subject: Security ID" field will show who deleted each file.

    For your situation, I would recommend using the Procmon tool to identify the process of deleting the Event Viewer logs.

    Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. You can get the tool from here https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

    System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log.You can get the tool from here https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

    Hope this resolves your Query !!

    --If the reply is helpful, please Upvote and Accept it as an answer–

    0 comments No comments