using powershell to set an event logs "Maximum Size" action

2
votes

When viewing an Event Logs properties (in Server 2008) you can set three actions for what to happen when the maximum event log size has been reached:

  • Overwrite events as needed
  • Archive the log when full
  • Do not overwrite events

Using Powershell I can use limit-eventlog to set the event log retention to set the OverflowAction to DoNotOverwrite or OverwriteAsNeeded, but I cannot seem to be able to get the Archive the log when full action selected.

Any ideas how I could select this option via powershell?

1
c#powershellevent-log

1 Answers

3
votes

The only way (IMO) is to modifying the registry. Here an example to set 'Archive the log when full' action for the Application log:

new-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Application `
-name AutoBackupLogFiles -Value 1 -PropertyType 'dword'

if the options have been selected previously, the key is already present so just need set to 1 the key value:

set-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Application `
    -name AutoBackupLogFiles -Value 1