Sysmon archive folder too big

Question

Hi all.
I'm using sysmon with a lot of rules and I'm having a problem, which has been previously exposed here:
The archive folder is getting way too big and I can't find any relevant information on how we should clean this folder. Keeping in mind that I have over 100 stations where sysmon is installed, manually deleting the files from all of them is not a solution.
Does anyone have any tested and working solution for keeping the archive folder size under control?

Answer 1

Cleaning an archive of logs is really a business decision. How far back do you want to keep logs? This is often based upon what problems you're trying to diagnose by logging. For example if you only really need the logs for the first week of a month then everything else can be thrown away. If problems are generally detected within a week then anything over a week is probably not worth keeping.

You can write a script to do the cleanup and then schedule it to run via Task Scheduler. That's how we manage all the logs on the servers we need to clean up. The script itself is trivial but, again, must be adjusted based upon your business requirements.

For example, here's a PS script that deletes all files over a week old (not tested).

# Get the files to delete
$files = Get-ChildItem $source -Recurse | Where-Object { $_.LastWriteTime -lt [DateTime]::Now.AddDays(-7) }

# Verify the files are correct for testing purposes
$files | Remove-Item -Force -WhatIf

# This one actually removes them
$files | Remove-Item -Force

If you need the logs for a log time then you could optionally just zip up logs over a certain age and then remove the logs leaving the zip file behind.