Event-Log Retention days instead of size

Question

Hi there,

I'd like to know if there is a possibility to change Windows-Eventlog-retention from "max size xy KB" to "max xy days". I know there is a GPO named "Retention method for application/security/system log" and "Retain application/security/system log" in Security-Settings\Event Log but obviously it does not work :-(

I created a policy to change this settings to 90 days. The policy has been applied correctly but I still see events in Event Viewer that are much older than 90 days.

Regards
Miranda

Answer 1

Hi,
Based on my understanding, size and time are two different aspects of event logs, and you can make the modification through group policy. Please take a look at this article and see if it helps:
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/0b9673a7-ce0a-49b4-912b-591efdb37cdf

Thanks for your time.
Best regards,
Danny

-----------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi,

sorry answer was not helpful...

I have already setup the Policy with the setting "Retention method for application/security/system log" and "Retain application/security/system log" to 90 days in Security-Settings\Event Log but on a machine that has the policy applied I still see much older entries in event-log.

]1

Whats wrong?

Regards
Miranda

Answer 3

Hi,
I’m not sure if this would be the cause, but would you check if the marked part of the settings?
As far as I’m concerned, if you choose to clear the logs manually, unless you do it, the old logs won’t be overwritten:

For your reference:
https://helpcenter.netwrix.com/NA/Configure_IT_Infrastructure/File_Servers/Windows_Shares/WSh_EventLog.html
Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Thanks for your time.
Best regards,
Danny

-----------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

we have "overwrite as needed" already set ... but still events from 2020

Answer 5

that's what I'm now trying. Have set the policy to retain application logs for 1 day. Will check on monday...
Cheers